dorkos 0.121.0 → 0.123.0

package/dist/bin/cli.js

@@ -22178,15 +22178,26 @@ var init_runtime_settings = __esm({
        * agent is the same executable with the same permissions and the same
        * per-dispatch boundary check, held open for longer — nothing about what
        * it may DO changes. The real cost is memory, and the bounds on it live
-       * in code rather than under this setting: at most twelve stay warm, about
-       * 1 GB each worst case, and the idle reaper closes the rest.
+       * in `maxWarmProcesses` below, and the idle
+       * reaper closes the rest.
        *
        * Read when a chat's agent starts, so a chat already under way keeps
        * the way it started until its process is replaced. That is what lets
        * one machine run chats both ways at the same time and compare them on
        * the same work (spec `persistent-session-runtime` §P3).
        */
-      persistentSession: external_exports.boolean().default(true)
+      persistentSession: external_exports.boolean().default(true),
+      /**
+       * The most chats whose agent may be running at once on this machine
+       * (DOR-3012). `null`, the default, sizes it to the machine's memory: one per
+       * 2 GB, at least 12 and at most 32. A number pins it.
+       *
+       * A chat past the limit is never refused outright: the least recently used
+       * idle agent is closed to make room, and when every one is mid-turn the chat
+       * waits for one to finish. Read when an agent starts, so a change applies to
+       * the next one.
+       */
+      maxWarmProcesses: external_exports.number().int().min(1).max(128).nullable().default(null)
     });
     DoeInferenceConfigSchema = external_exports.object({
       source: external_exports.enum(["api-key", "local", "dorkos-credits"]),
@@ -22284,7 +22295,8 @@ var init_runtime_settings = __esm({
         // carry this value — the per-field one on `ClaudeCodeSettingsSchema`,
         // this one, and the `runtimes` literal below — and all three have to
         // agree or the shallow defaults-merge lands somebody on the old value.
-        persistentSession: true
+        persistentSession: true,
+        maxWarmProcesses: null
       })),
       doe: DoeRuntimeSettingsSchema,
       opencode: external_exports.object({
@@ -22377,7 +22389,8 @@ var init_runtime_settings = __esm({
         defaultModel: null,
         defaultEffort: null,
         defaultTrustStop: null,
-        persistentSession: true
+        persistentSession: true,
+        maxWarmProcesses: null
       },
       opencode: {
         enabled: true,
@@ -26362,7 +26375,6 @@ function repoUrl(path66 = "") {
 var GITHUB_ORG, links;
 var init_links = __esm({
   "../shared/src/links.ts"() {
-    "use strict";
     GITHUB_ORG = "dork-labs";
     links = {
       /** The public origin of the marketing site, the docs and DorkOS Cloud. */
@@ -26761,7 +26773,7 @@ import path2 from "path";
 import { fileURLToPath } from "url";
 function resolveVersion() {
   if (env2.DORKOS_VERSION_OVERRIDE) return env2.DORKOS_VERSION_OVERRIDE;
-  if (true) return "0.121.0";
+  if (true) return "0.123.0";
   const pkgPath = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "../../package.json");
   return JSON.parse(readFileSync(pkgPath, "utf-8")).version;
 }
@@ -28210,7 +28222,7 @@ var init_interceptor = __esm({
           for (const callback of this.callbacks) {
             callback();
           }
-          if (signal) {
+          if (signal && process6.listenerCount(signal) === 0) {
             if (IS_WINDOWS && (signal !== "SIGINT" && signal !== "SIGTERM" && signal !== "SIGKILL")) {
               process6.kill(process6.pid, "SIGTERM");
             } else {
@@ -40753,6 +40765,12 @@ function seedLanAccess(store) {
   if ("lanAccess" in server2) return;
   store.set("server", { ...server2, lanAccess: false });
 }
+function seedMaxWarmProcesses(store) {
+  const claudeCode = store.get("runtimes.claudeCode");
+  if (claudeCode === null || typeof claudeCode !== "object" || Array.isArray(claudeCode)) return;
+  if ("maxWarmProcesses" in claudeCode) return;
+  store.set("runtimes.claudeCode", { ...claudeCode, maxWarmProcesses: null });
+}
 function raiseEngagedWindowDefaults(store) {
   if (store.get("rooms") === void 0) return;
   const minutes = store.get("rooms.engagedWindowMinutes");
@@ -41451,7 +41469,14 @@ var init_config_migrations = __esm({
             enabled: sessionRelay.enabled === true
           });
         }
-      }
+      },
+      // v0.122.0 is the newest release, so this opens 0.123.0. Frozen from merge;
+      // anything further opens `'0.124.0'`.
+      //
+      // Writes `runtimes.claudeCode.maxWarmProcesses: null` where the stored
+      // section lacks it, and touches nothing else (DOR-3012). See
+      // `seedMaxWarmProcesses`.
+      "0.123.0": seedMaxWarmProcesses
     };
   }
 });
@@ -41550,6 +41575,7 @@ __export(config_manager_exports, {
   seedIdentityPromptDismissedDefault: () => seedIdentityPromptDismissedDefault,
   seedLanAccess: () => seedLanAccess,
   seedMaxConcurrentTurnsPerAgent: () => seedMaxConcurrentTurnsPerAgent,
+  seedMaxWarmProcesses: () => seedMaxWarmProcesses,
   seedMemoryProviderDefault: () => seedMemoryProviderDefault,
   seedPermissionPresetFromDoor: () => seedPermissionPresetFromDoor,
   seedRoomCanvasOps: () => seedRoomCanvasOps,
@@ -49414,6 +49440,7 @@ function parseSkillFile(filePath, content, schema3, options) {
 }
 var init_parser = __esm({
   "../skills/src/parser.ts"() {
+    "use strict";
     init_constants7();
     init_frontmatter();
   }
@@ -52983,6 +53010,27 @@ var init_mesh_schemas = __esm({
   }
 });
 
+// ../shared/src/direct-notes-context.ts
+var DirectNotesDataSchema;
+var init_direct_notes_context = __esm({
+  "../shared/src/direct-notes-context.ts"() {
+    "use strict";
+    init_zod();
+    DirectNotesDataSchema = external_exports.object({
+      withName: external_exports.string().min(1),
+      notes: external_exports.array(
+        external_exports.object({
+          at: external_exports.string().min(1),
+          from: external_exports.string().min(1),
+          fromYou: external_exports.boolean(),
+          text: external_exports.string()
+        })
+      ).min(1),
+      omitted: external_exports.number().int().nonnegative()
+    });
+  }
+});
+
 // ../shared/src/additional-context.ts
 var GitStatusDataSchema, EnvDataSchema, RelayContextDataSchema, RoomContextOriginSchema, RoomContextAuthorSchema, RoomContextMemberSchema, RoomContextEntrySchema, RoomContextAcknowledgmentSchema, MainMovedSchema, WorktreeRefreshOutcomeSchema, RoomContextFilesSchema, RoomContextDataSchema, SeedContextDataSchema, StagedContextDataSchema, AccountsAccessDataSchema, ContextWarningDataSchema, ApprovalVerdictDataSchema, AdditionalContextEntrySchema, AdditionalContextSchema, ClientContextSchema;
 var init_additional_context = __esm({
@@ -52992,6 +53040,7 @@ var init_additional_context = __esm({
     init_canvas_channel_schemas();
     init_mesh_schemas();
     init_schemas4();
+    init_direct_notes_context();
     GitStatusDataSchema = external_exports.object({
       isRepo: external_exports.boolean(),
       branch: external_exports.string().optional(),
@@ -53214,6 +53263,11 @@ var init_additional_context = __esm({
         scope: external_exports.literal("per-turn"),
         data: ApprovalVerdictDataSchema
       }),
+      external_exports.object({
+        kind: external_exports.literal("direct_notes"),
+        scope: external_exports.literal("per-turn"),
+        data: DirectNotesDataSchema
+      }),
       external_exports.object({
         kind: external_exports.literal("context_warning"),
         scope: external_exports.literal("per-turn"),
@@ -83015,7 +83069,7 @@ var init_factory = __esm({
         }
         return transformedData;
       };
-      const transformOutput = async (data, inputModel, select2 = [], join61) => {
+      const transformOutput = async (data, inputModel, select2 = [], join62) => {
         const transformSingleOutput = async (data2, inputModel2, select3 = []) => {
           if (!data2) return null;
           const modelKey2 = getDefaultModelName(inputModel2);
@@ -83052,10 +83106,10 @@ var init_factory = __esm({
           }
           return transformedData2;
         };
-        if (!join61 || Object.keys(join61).length === 0) return await transformSingleOutput(data, inputModel, select2);
+        if (!join62 || Object.keys(join62).length === 0) return await transformSingleOutput(data, inputModel, select2);
         const modelKey = getDefaultModelName(inputModel);
         const transformedData = await transformSingleOutput(data, modelKey, select2);
-        const requiredModels = Object.entries(join61).map(([model, joinConfig]) => ({
+        const requiredModels = Object.entries(join62).map(([model, joinConfig]) => ({
           modelName: model,
           defaultModelName: joinConfig.modelKey ?? getDefaultModelName(model),
           joinConfig
@@ -83154,8 +83208,8 @@ var init_factory = __esm({
         if (!unsanitizedJoin) return void 0;
         if (Object.keys(unsanitizedJoin).length === 0) return void 0;
         const transformedJoin = {};
-        for (const [model, join61] of Object.entries(unsanitizedJoin)) {
-          if (!join61) continue;
+        for (const [model, join62] of Object.entries(unsanitizedJoin)) {
+          if (!join62) continue;
           const defaultModelName = getDefaultModelName(model);
           const defaultBaseModelName = getDefaultModelName(baseModel);
           let foreignKeys = Object.entries(schema3[defaultModelName].fields).filter(([field, fieldAttributes]) => fieldAttributes.references && getDefaultModelName(fieldAttributes.references.model) === defaultBaseModelName);
@@ -83196,7 +83250,7 @@ var init_factory = __esm({
           const isUnique = to === "id" ? true : foreignKeyAttributes.unique ?? false;
           let limit = options.advanced?.database?.defaultFindManyLimit ?? 100;
           if (isUnique) limit = 1;
-          else if (typeof join61 === "object" && typeof join61.limit === "number") limit = join61.limit;
+          else if (typeof join62 === "object" && typeof join62.limit === "number") limit = join62.limit;
           transformedJoin[getModelName(model)] = {
             modelKey: model,
             on: {
@@ -83429,21 +83483,21 @@ var init_factory = __esm({
             where: unsafeWhere,
             action: "findOne"
           });
-          let join61;
+          let join62;
           let passJoinToAdapter = true;
           if (!config3.disableTransformJoin) {
             const result2 = transformJoinClause(modelKey, unsafeJoin, select2);
             if (result2) {
-              join61 = result2.join;
+              join62 = result2.join;
               select2 = result2.select;
             }
-            if (!options.advanced?.database?.joins && join61 && Object.keys(join61).length > 0) passJoinToAdapter = false;
-          } else join61 = unsafeJoin;
+            if (!options.advanced?.database?.joins && join62 && Object.keys(join62).length > 0) passJoinToAdapter = false;
+          } else join62 = unsafeJoin;
           debugLog({ method: "findOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(1, 3)}`, `${formatMethod("findOne")}:`, {
             model,
             where,
             select: select2,
-            join: join61
+            join: join62
           });
           const res = await withSpan3(`db findOne ${model}`, {
             [ATTR_DB_OPERATION_NAME]: "findOne",
@@ -83453,14 +83507,14 @@ var init_factory = __esm({
             modelKey,
             where,
             select: select2,
-            join: passJoinToAdapter ? join61 : void 0
+            join: passJoinToAdapter ? join62 : void 0
           }));
           debugLog({ method: "findOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(2, 3)}`, `${formatMethod("findOne")} ${formatAction("DB Result")}:`, {
             model,
             data: res
           });
           let transformed = res;
-          if (!config3.disableTransformOutput) transformed = await transformOutput(res, modelKey, select2, join61);
+          if (!config3.disableTransformOutput) transformed = await transformOutput(res, modelKey, select2, join62);
           debugLog({ method: "findOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(3, 3)}`, `${formatMethod("findOne")} ${formatAction("Parsed Result")}:`, {
             model,
             data: transformed
@@ -83478,23 +83532,23 @@ var init_factory = __esm({
             where: unsafeWhere,
             action: "findMany"
           });
-          let join61;
+          let join62;
           let passJoinToAdapter = true;
           if (!config3.disableTransformJoin) {
             const result2 = transformJoinClause(modelKey, unsafeJoin, select2);
             if (result2) {
-              join61 = result2.join;
+              join62 = result2.join;
               select2 = result2.select;
             }
-            if (!options.advanced?.database?.joins && join61 && Object.keys(join61).length > 0) passJoinToAdapter = false;
-          } else join61 = unsafeJoin;
+            if (!options.advanced?.database?.joins && join62 && Object.keys(join62).length > 0) passJoinToAdapter = false;
+          } else join62 = unsafeJoin;
           debugLog({ method: "findMany" }, `${formatTransactionId(thisTransactionId)} ${formatStep(1, 3)}`, `${formatMethod("findMany")}:`, {
             model,
             where,
             limit,
             sortBy,
             offset,
-            join: join61
+            join: join62
           });
           const res = await withSpan3(`db findMany ${model}`, {
             [ATTR_DB_OPERATION_NAME]: "findMany",
@@ -83507,7 +83561,7 @@ var init_factory = __esm({
             select: select2,
             sortBy,
             offset,
-            join: passJoinToAdapter ? join61 : void 0
+            join: passJoinToAdapter ? join62 : void 0
           }));
           debugLog({ method: "findMany" }, `${formatTransactionId(thisTransactionId)} ${formatStep(2, 3)}`, `${formatMethod("findMany")} ${formatAction("DB Result")}:`, {
             model,
@@ -83515,7 +83569,7 @@ var init_factory = __esm({
           });
           let transformed = res;
           if (!config3.disableTransformOutput) transformed = await Promise.all(res.map(async (r3) => {
-            return await transformOutput(r3, modelKey, void 0, join61);
+            return await transformOutput(r3, modelKey, void 0, join62);
           }));
           debugLog({ method: "findMany" }, `${formatTransactionId(thisTransactionId)} ${formatStep(3, 3)}`, `${formatMethod("findMany")} ${formatAction("Parsed Result")}:`, {
             model,
@@ -83870,7 +83924,7 @@ var init_dist9 = __esm({
               return sortBy.direction === "asc" ? comparison : -comparison;
             });
           };
-          function convertWhereClause(where, model, modelKey, join61, select2) {
+          function convertWhereClause(where, model, modelKey, join62, select2) {
             const baseRecords = (() => {
               const table2 = activeDb2[model];
               if (!table2) {
@@ -83930,14 +83984,14 @@ var init_dist9 = __esm({
               })))));
               return records;
             })();
-            if (!join61) return baseRecords;
+            if (!join62) return baseRecords;
             const grouped = /* @__PURE__ */ new Map();
             const seenIds = /* @__PURE__ */ new Map();
             for (const baseRecord of baseRecords) {
               const baseId = String(baseRecord.id);
               if (!grouped.has(baseId)) {
                 const nested = { ...baseRecord };
-                for (const [joinModel, joinAttr] of Object.entries(join61)) {
+                for (const [joinModel, joinAttr] of Object.entries(join62)) {
                   const joinModelName = joinModel;
                   if (joinAttr.relation === "one-to-one") nested[joinModelName] = null;
                   else {
@@ -83948,7 +84002,7 @@ var init_dist9 = __esm({
                 grouped.set(baseId, nested);
               }
               const nestedEntry = grouped.get(baseId);
-              for (const [joinModel, joinAttr] of Object.entries(join61)) {
+              for (const [joinModel, joinAttr] of Object.entries(join62)) {
                 const joinModelName = joinModel;
                 const joinTable = activeDb2[joinModelName];
                 if (!joinTable) {
@@ -83981,18 +84035,18 @@ var init_dist9 = __esm({
               activeDb2[model].push(data);
               return data;
             },
-            findOne: async ({ model, modelKey = model, where, select: select2, join: join61 }) => {
-              const res = convertWhereClause(where, model, modelKey, join61, select2);
-              if (join61) {
+            findOne: async ({ model, modelKey = model, where, select: select2, join: join62 }) => {
+              const res = convertWhereClause(where, model, modelKey, join62, select2);
+              if (join62) {
                 const resArray = res;
                 if (!resArray.length) return null;
                 return resArray[0];
               }
               return res[0] || null;
             },
-            findMany: async ({ model, modelKey = model, where, sortBy, limit, select: select2, offset, join: join61 }) => {
-              const res = convertWhereClause(where || [], model, modelKey, join61, select2);
-              if (join61) {
+            findMany: async ({ model, modelKey = model, where, sortBy, limit, select: select2, offset, join: join62 }) => {
+              const res = convertWhereClause(where || [], model, modelKey, join62, select2);
+              if (join62) {
                 const resArray = res;
                 if (!resArray.length) return [];
                 applySortToRecords(resArray, sortBy, modelKey);
@@ -85990,10 +86044,10 @@ var init_query_node = __esm({
           where: node2.where ? WhereNode.cloneWithOperation(node2.where, "And", operation) : WhereNode.create(operation)
         });
       },
-      cloneWithJoin(node2, join61) {
+      cloneWithJoin(node2, join62) {
         return freeze({
           ...node2,
-          joins: node2.joins ? freeze([...node2.joins, join61]) : freeze([join61])
+          joins: node2.joins ? freeze([...node2.joins, join62]) : freeze([join62])
         });
       },
       cloneWithReturning(node2, selections) {
@@ -90504,8 +90558,8 @@ var init_with_schema_transformer = __esm({
           this.#collectSchemableIdsFromTableExpr(node2.table, schemableIds);
         }
         if ("joins" in node2 && node2.joins) {
-          for (const join61 of node2.joins) {
-            this.#collectSchemableIdsFromTableExpr(join61.table, schemableIds);
+          for (const join62 of node2.joins) {
+            this.#collectSchemableIdsFromTableExpr(join62.table, schemableIds);
           }
         }
         if ("using" in node2 && node2.using) {
@@ -102677,7 +102731,7 @@ var init_mssql_introspector = __esm({
         return await this.#db.selectFrom("sys.schemas").select("name").execute();
       }
       async getTables(options = { withInternalKyselyTables: false }) {
-        const rawColumns = await this.#db.selectFrom("sys.tables as tables").leftJoin("sys.schemas as table_schemas", "table_schemas.schema_id", "tables.schema_id").innerJoin("sys.columns as columns", "columns.object_id", "tables.object_id").innerJoin("sys.types as types", "types.user_type_id", "columns.user_type_id").leftJoin("sys.schemas as type_schemas", "type_schemas.schema_id", "types.schema_id").leftJoin("sys.extended_properties as comments", (join61) => join61.onRef("comments.major_id", "=", "tables.object_id").onRef("comments.minor_id", "=", "columns.column_id").on("comments.name", "=", "MS_Description")).$if(!options.withInternalKyselyTables, (qb) => qb.where("tables.name", "!=", DEFAULT_MIGRATION_TABLE).where("tables.name", "!=", DEFAULT_MIGRATION_LOCK_TABLE)).select([
+        const rawColumns = await this.#db.selectFrom("sys.tables as tables").leftJoin("sys.schemas as table_schemas", "table_schemas.schema_id", "tables.schema_id").innerJoin("sys.columns as columns", "columns.object_id", "tables.object_id").innerJoin("sys.types as types", "types.user_type_id", "columns.user_type_id").leftJoin("sys.schemas as type_schemas", "type_schemas.schema_id", "types.schema_id").leftJoin("sys.extended_properties as comments", (join62) => join62.onRef("comments.major_id", "=", "tables.object_id").onRef("comments.minor_id", "=", "columns.column_id").on("comments.name", "=", "MS_Description")).$if(!options.withInternalKyselyTables, (qb) => qb.where("tables.name", "!=", DEFAULT_MIGRATION_TABLE).where("tables.name", "!=", DEFAULT_MIGRATION_LOCK_TABLE)).select([
           "tables.name as table_name",
           (eb) => eb.ref("tables.type").$castTo().as("table_type"),
           "table_schemas.name as table_schema_name",
@@ -102692,7 +102746,7 @@ var init_mssql_introspector = __esm({
           "types.name as type_name",
           "type_schemas.name as type_schema_name",
           "comments.value as column_comment"
-        ]).unionAll(this.#db.selectFrom("sys.views as views").leftJoin("sys.schemas as view_schemas", "view_schemas.schema_id", "views.schema_id").innerJoin("sys.columns as columns", "columns.object_id", "views.object_id").innerJoin("sys.types as types", "types.user_type_id", "columns.user_type_id").leftJoin("sys.schemas as type_schemas", "type_schemas.schema_id", "types.schema_id").leftJoin("sys.extended_properties as comments", (join61) => join61.onRef("comments.major_id", "=", "views.object_id").onRef("comments.minor_id", "=", "columns.column_id").on("comments.name", "=", "MS_Description")).select([
+        ]).unionAll(this.#db.selectFrom("sys.views as views").leftJoin("sys.schemas as view_schemas", "view_schemas.schema_id", "views.schema_id").innerJoin("sys.columns as columns", "columns.object_id", "views.object_id").innerJoin("sys.types as types", "types.user_type_id", "columns.user_type_id").leftJoin("sys.schemas as type_schemas", "type_schemas.schema_id", "types.schema_id").leftJoin("sys.extended_properties as comments", (join62) => join62.onRef("comments.major_id", "=", "views.object_id").onRef("comments.minor_id", "=", "columns.column_id").on("comments.name", "=", "MS_Description")).select([
           "views.name as table_name",
           "views.type as table_type",
           "view_schemas.name as table_schema_name",
@@ -103919,10 +103973,10 @@ var init_dist11 = __esm({
             mysqlNoIdWarned = true;
             logger2.warn(`[Kysely Adapter] MySQL does not support INSERT...RETURNING. With generateId set to false, the adapter uses best-effort fallback strategies (unique columns, full-field match) to retrieve inserted rows. For reliable behavior, use Better Auth's default ID generation, a custom generateId function, or generateId: "serial" for auto-increment.`);
           }
-          const selectAllJoins = (join61) => {
+          const selectAllJoins = (join62) => {
             const allSelects = [];
             const allSelectsStr = [];
-            if (join61) for (const [joinModel, joinConfig] of Object.entries(join61)) {
+            if (join62) for (const [joinModel, joinConfig] of Object.entries(join62)) {
               const fields = schema3[joinConfig.modelKey ?? getDefaultModelName(joinModel)]?.fields;
               const [_joinModelSchema, joinModelName] = joinModel.includes(".") ? joinModel.split(".") : [void 0, joinModel];
               if (!fields) continue;
@@ -104147,7 +104201,7 @@ var init_dist11 = __esm({
             async create({ data, model, modelKey = model }) {
               return await withReturning(data, db2.insertInto(model).values(data), model, modelKey, []);
             },
-            async findOne({ model, modelKey = model, where, select: select2, join: join61 }) {
+            async findOne({ model, modelKey = model, where, select: select2, join: join62 }) {
               const { and: and2, or: or2 } = convertWhereClause(model, modelKey, where);
               let query = db2.selectFrom((eb) => {
                 let b2 = eb.selectFrom(model);
@@ -104160,19 +104214,19 @@ var init_dist11 = __esm({
                 else b2 = b2.selectAll();
                 return b2.as("primary");
               }).selectAll("primary");
-              if (join61) for (const [joinModel, joinAttr] of Object.entries(join61)) {
+              if (join62) for (const [joinModel, joinAttr] of Object.entries(join62)) {
                 const [_joinModelSchema, joinModelName] = joinModel.includes(".") ? joinModel.split(".") : [void 0, joinModel];
-                query = query.leftJoin(`${joinModel} as join_${joinModelName}`, (join62) => join62.onRef(`join_${joinModelName}.${joinAttr.on.to}`, "=", `primary.${joinAttr.on.from}`));
+                query = query.leftJoin(`${joinModel} as join_${joinModelName}`, (join63) => join63.onRef(`join_${joinModelName}.${joinAttr.on.to}`, "=", `primary.${joinAttr.on.from}`));
               }
-              const { allSelectsStr, allSelects } = selectAllJoins(join61);
+              const { allSelectsStr, allSelects } = selectAllJoins(join62);
               query = query.select(allSelects);
               const res = await query.execute();
               if (!res || !Array.isArray(res) || res.length === 0) return null;
               const row2 = res[0];
-              if (join61) return processJoinedResults(res, join61, allSelectsStr)[0];
+              if (join62) return processJoinedResults(res, join62, allSelectsStr)[0];
               return row2;
             },
-            async findMany({ model, modelKey = model, where, limit, select: select2, offset, sortBy, join: join61 }) {
+            async findMany({ model, modelKey = model, where, limit, select: select2, offset, sortBy, join: join62 }) {
               const { and: and2, or: or2 } = convertWhereClause(model, modelKey, where);
               let query = db2.selectFrom((eb) => {
                 let b2 = eb.selectFrom(model);
@@ -104201,11 +104255,11 @@ var init_dist11 = __esm({
                 else b2 = b2.selectAll();
                 return b2.as("primary");
               }).selectAll("primary");
-              if (join61) for (const [joinModel, joinAttr] of Object.entries(join61)) {
+              if (join62) for (const [joinModel, joinAttr] of Object.entries(join62)) {
                 const [_joinModelSchema, joinModelName] = joinModel.includes(".") ? joinModel.split(".") : [void 0, joinModel];
-                query = query.leftJoin(`${joinModel} as join_${joinModelName}`, (join62) => join62.onRef(`join_${joinModelName}.${joinAttr.on.to}`, "=", `primary.${joinAttr.on.from}`));
+                query = query.leftJoin(`${joinModel} as join_${joinModelName}`, (join63) => join63.onRef(`join_${joinModelName}.${joinAttr.on.to}`, "=", `primary.${joinAttr.on.from}`));
               }
-              const { allSelectsStr, allSelects } = selectAllJoins(join61);
+              const { allSelectsStr, allSelects } = selectAllJoins(join62);
               query = query.select(allSelects);
               if (sortBy?.field) query = query.orderBy(`${getFieldName({
                 model: modelKey,
@@ -104213,7 +104267,7 @@ var init_dist11 = __esm({
               })}`, sortBy.direction);
               const res = await query.execute();
               if (!res) return [];
-              if (join61) return processJoinedResults(res, join61, allSelectsStr);
+              if (join62) return processJoinedResults(res, join62, allSelectsStr);
               return res;
             },
             async update({ model, modelKey = model, where, update: values2 }) {
@@ -107146,7 +107200,7 @@ var init_sql2 = __esm({
         return new SQL([new StringChunk(str2)]);
       }
       sql22.raw = raw;
-      function join61(chunks, separator) {
+      function join62(chunks, separator) {
         const result2 = [];
         for (const [i2, chunk] of chunks.entries()) {
           if (i2 > 0 && separator !== void 0) {
@@ -107156,7 +107210,7 @@ var init_sql2 = __esm({
         }
         return new SQL(result2);
       }
-      sql22.join = join61;
+      sql22.join = join62;
       function identifier(value) {
         return new Name(value);
       }
@@ -108507,10 +108561,10 @@ var init_dist14 = __esm({
             checkMissingFields(table2, modelKey, values2);
             return await withReturning(model, modelKey, db2.insert(table2).values(values2), values2);
           },
-          async findOne({ model, modelKey = model, where, select: select2, join: join61 }) {
+          async findOne({ model, modelKey = model, where, select: select2, join: join62 }) {
             const table2 = getSchema2(model);
             const clause = convertWhereClause(where, model, modelKey);
-            if (join61) {
+            if (join62) {
               const queryModel = getQueryModel(model);
               if (!db2.query || !queryModel) {
                 logger2.error(`[# Drizzle Adapter]: The model "${model}" was not found in the query object. Please update your Drizzle schema to include relations or re-generate using "npx auth@latest generate".`);
@@ -108520,7 +108574,7 @@ var init_dist14 = __esm({
                 const renamedJoinResults = [];
                 const relationKeys = getRelationKeysByModel().get(queryModel);
                 includes = {};
-                const joinEntries = Object.entries(join61);
+                const joinEntries = Object.entries(join62);
                 for (const [joinModel, joinAttr] of joinEntries) {
                   const limit = joinAttr.limit ?? options.advanced?.database?.defaultFindManyLimit ?? 100;
                   const isUnique = joinAttr.relation === "one-to-one";
@@ -108562,11 +108616,11 @@ var init_dist14 = __esm({
             if (!res.length) return null;
             return res[0];
           },
-          async findMany({ model, modelKey = model, where, sortBy, limit, select: select2, offset, join: join61 }) {
+          async findMany({ model, modelKey = model, where, sortBy, limit, select: select2, offset, join: join62 }) {
             const table2 = getSchema2(model);
             const clause = where ? convertWhereClause(where, model, modelKey) : [];
             const sortFn = sortBy?.direction === "desc" ? desc : asc;
-            if (join61) {
+            if (join62) {
               const queryModel = getQueryModel(model);
               if (!db2.query || !queryModel) {
                 logger2.error(`[# Drizzle Adapter]: The model "${model}" was not found in the query object. Please update your Drizzle schema to include relations or re-generate using "npx auth@latest generate".`);
@@ -108576,7 +108630,7 @@ var init_dist14 = __esm({
                 const renamedJoinResults = [];
                 const relationKeys = getRelationKeysByModel().get(queryModel);
                 includes = {};
-                const joinEntries = Object.entries(join61);
+                const joinEntries = Object.entries(join62);
                 for (const [joinModel, joinAttr] of joinEntries) {
                   const isUnique = joinAttr.relation === "one-to-one";
                   const limit2 = joinAttr.limit ?? options.advanced?.database?.defaultFindManyLimit ?? 100;
@@ -120183,7 +120237,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table2);
           for (const item of extractUsedTable(table2)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join61) => join61.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins?.some((join62) => join62.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (!this.isPartialSelect) {
@@ -121069,7 +121123,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return (table2, on) => {
           const tableName = getTableLikeName(table2);
-          if (typeof tableName === "string" && this.config.joins.some((join61) => join61.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins.some((join62) => join62.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (typeof on === "function") {
@@ -123798,6 +123852,11 @@ var init_auth = __esm({
         updatedAt: integer2("updated_at", { mode: "timestamp_ms" }).$onUpdate(() => /* @__PURE__ */ new Date()).notNull(),
         ipAddress: text("ip_address"),
         userAgent: text("user_agent"),
+        // The way the sign-in that made this session came in: 'local', 'wifi',
+        // 'tunnel', 'managed', 'network' or 'hub'. A session works only on that
+        // route (DOR-2969). Null for a session made before it was recorded, which
+        // works only on this computer.
+        route: text("route"),
         userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
         // A sign-in on a shared or public computer (A4, DOR-2936): the cookie ends
         // with the browser, the session cannot outlive a working day, and the app
@@ -126222,7 +126281,8 @@ var init_notifications = __esm({
             "community.owner-replacement",
             "heartbeat.credits-offer",
             "connector.destructive_pending",
-            "connector.destructive_executed"
+            "connector.destructive_executed",
+            "web.new_device"
           ]
         }).notNull(),
         /** How loud this was allowed to be. Copied from the registry at write time. */
@@ -128889,6 +128949,18 @@ var init_setup_code_gate = __esm({
   }
 });
 
+// ../../apps/server/src/services/core/auth/sessions/session-route.ts
+var WIFI_SESSION_MAX_SECONDS;
+var init_session_route = __esm({
+  "../../apps/server/src/services/core/auth/sessions/session-route.ts"() {
+    "use strict";
+    init_request_classifier();
+    init_server_role();
+    init_registration_policy();
+    WIFI_SESSION_MAX_SECONDS = 7 * 24 * 60 * 60;
+  }
+});
+
 // ../../apps/server/src/services/core/auth/cookie-security.ts
 var AUTH_COOKIES_SECURE;
 var init_cookie_security = __esm({
@@ -128900,7 +128972,7 @@ var init_cookie_security = __esm({
 });
 
 // ../shared/src/session-relay.ts
-var SESSION_RELAY_MAX_FRAME_LENGTH, SESSION_RELAY_MAX_MESSAGE_LENGTH, SESSION_RELAY_MAX_CHATS, SESSION_RELAY_IDLE_CLOSE_MS, VersionSchema, RelayVersionRangeSchema, AdvertisedFeaturesSchema, RequestIdSchema, StreamIdSchema, SessionIdSchema, AgentIdSchema, ToolCallIdSchema, ResumeCursorSchema, base64url3, ChatsListRequestSchema, SessionStreamRequestSchema, SessionSendRequestSchema, SessionInterruptRequestSchema, ApprovalDecisionSchema, InteractionChallengeRequestSchema, RelayApprovalProofSchema, InteractionAnswerSchema, InteractionRespondRequestSchema, RelayRequestSchema, RelayChatSummarySchema, RelayResultBodySchemas, RelayErrorSchema, exactBase64url, RelayEphemeralKeySchema, RelaySignatureSchema, RelayNonceSchema, RelayPinnedHubKeySchema, RelayHelloFrameSchema, RelayHandshakeAnswerSchema, RelaySealedFrameSchema, HeartbeatFrameSchema, RelayWebFrameSchema, RelayStreamFrameSchema, RelayComputerFrameSchema, RelayFinishFrameSchema;
+var SESSION_RELAY_MAX_FRAME_LENGTH, SESSION_RELAY_MAX_MESSAGE_LENGTH, SESSION_RELAY_MAX_CHATS, SESSION_RELAY_IDLE_CLOSE_MS, VersionSchema, RelayVersionRangeSchema, AdvertisedFeaturesSchema, RequestIdSchema, StreamIdSchema, SessionIdSchema, AgentIdSchema, ToolCallIdSchema, ResumeCursorSchema, NO_CONTROL, INVISIBLE, RelayDisplayNameSchema, RelayDeviceSchema, base64url3, ChatsListRequestSchema, SessionStreamRequestSchema, SessionSendRequestSchema, SessionInterruptRequestSchema, ApprovalDecisionSchema, InteractionChallengeRequestSchema, RelayApprovalProofSchema, InteractionAnswerSchema, InteractionRespondRequestSchema, RelayRequestSchema, RelayChatSummarySchema, RelayResultBodySchemas, RelayErrorSchema, exactBase64url, RelayEphemeralKeySchema, RelaySignatureSchema, RelayNonceSchema, RelayPinnedHubKeySchema, RelayHelloFrameSchema, RelayHandshakeAnswerSchema, RelaySealedFrameSchema, HeartbeatFrameSchema, RelayWebFrameSchema, RelayStreamFrameSchema, RelayComputerFrameSchema, RelayFinishFrameSchema;
 var init_session_relay = __esm({
   "../shared/src/session-relay.ts"() {
     "use strict";
@@ -128919,6 +128991,13 @@ var init_session_relay = __esm({
     AgentIdSchema = external_exports.string().regex(/^[0-9A-HJKMNP-TV-Z]{26}$/);
     ToolCallIdSchema = external_exports.string().min(1).max(256).regex(/^[\w.:-]+$/);
     ResumeCursorSchema = external_exports.string().max(256).regex(/^[0-9a-f-]+-\d+-g\d+-\d+$/);
+    NO_CONTROL = /^[^\u0000-\u001f\u007f]*$/;
+    INVISIBLE = /[\p{Cf}\u2028\u2029]/u;
+    RelayDisplayNameSchema = external_exports.string().min(1).max(64).regex(NO_CONTROL).refine((name2) => name2.trim() === name2, "no leading or trailing whitespace").refine((name2) => !INVISIBLE.test(name2), "no invisible characters");
+    RelayDeviceSchema = external_exports.strictObject({
+      id: external_exports.string().min(8).max(64).regex(/^[A-Za-z0-9_-]+$/),
+      label: RelayDisplayNameSchema
+    });
     base64url3 = (max2) => external_exports.string().min(1).max(max2).regex(/^[A-Za-z0-9_-]+$/);
     ChatsListRequestSchema = external_exports.strictObject({
       op: external_exports.literal("chats.list"),
@@ -129061,7 +129140,13 @@ var init_session_relay = __esm({
        * `stream.frame`s and one `stream.end`, which carries the refusal if it never
        * opened.
        */
-      external_exports.strictObject({ type: external_exports.literal("request"), id: RequestIdSchema, request: RelayRequestSchema }),
+      external_exports.strictObject({
+        type: external_exports.literal("request"),
+        id: RequestIdSchema,
+        request: RelayRequestSchema,
+        /** The browser that asked; sent only to a computer that advertised `request.device`. */
+        device: RelayDeviceSchema.optional()
+      }),
       external_exports.strictObject({ type: external_exports.literal("stream.close"), streamId: StreamIdSchema }),
       /**
        * How many viewers have a chat of this computer open right now. At 0, and
@@ -129109,7 +129194,7 @@ var init_session_relay = __esm({
 });
 
 // ../shared/src/session-relay-link.ts
-var RELAY_LINK_CODE_TTL_MS, RelayLinkComputerIdSchema, Sha256Base64urlSchema, NO_CONTROL, INVISIBLE, RelayLinkComputerNameSchema, RelayLinkRequestSchema, RelayLinkResponseSchema, HubComputerSummarySchema, HubComputerListSchema, HubLinkCodeSchema, SessionRelayLevelSchema, SessionRelayStatusSchema, StepUpPasswordSchema, SessionRelayLinkBodySchema, SessionRelayLevelBodySchema, SessionRelayResumeBodySchema, SessionRelayLinkRefusalSchema;
+var RELAY_LINK_CODE_TTL_MS, RelayLinkComputerIdSchema, Sha256Base64urlSchema, NO_CONTROL2, RelayLinkComputerNameSchema, RelayLinkRequestSchema, RelayLinkResponseSchema, HubComputerSummarySchema, HubComputerListSchema, HubLinkCodeSchema, SessionRelayLevelSchema, SessionRelayStatusSchema, StepUpPasswordSchema, SessionRelayLinkBodySchema, SessionRelayLevelBodySchema, SessionRelayResumeBodySchema, SessionRelayLinkRefusalSchema, SessionRelayDeviceSchema, SessionRelayPresenceSchema, SessionRelayDeviceListSchema;
 var init_session_relay_link = __esm({
   "../shared/src/session-relay-link.ts"() {
     init_zod();
@@ -129117,9 +129202,8 @@ var init_session_relay_link = __esm({
     RELAY_LINK_CODE_TTL_MS = 10 * 60 * 1e3;
     RelayLinkComputerIdSchema = external_exports.string().min(1).max(64).regex(/^[\w.:-]+$/);
     Sha256Base64urlSchema = external_exports.string().length(43).regex(/^[A-Za-z0-9_-]+$/);
-    NO_CONTROL = /^[^\u0000-\u001f\u007f]*$/;
-    INVISIBLE = /[\p{Cf}\u2028\u2029]/u;
-    RelayLinkComputerNameSchema = external_exports.string().min(1).max(64).regex(NO_CONTROL).refine((name2) => name2.trim() === name2, "no leading or trailing whitespace").refine((name2) => !INVISIBLE.test(name2), "no invisible characters");
+    NO_CONTROL2 = /^[^\u0000-\u001f\u007f]*$/;
+    RelayLinkComputerNameSchema = RelayDisplayNameSchema;
     RelayLinkRequestSchema = external_exports.strictObject({
       v: external_exports.literal(1),
       /** The code part of the link code, as the owner pasted it. */
@@ -129137,9 +129221,9 @@ var init_session_relay_link = __esm({
       /** The hub's Ed25519 public key, raw 32 bytes base64url. Pin this one. */
       hubKey: RelayPinnedHubKeySchema,
       /** The hub owner's account id at `issuer`. */
-      ownerAccountId: external_exports.string().min(1).max(128).regex(NO_CONTROL).optional(),
+      ownerAccountId: external_exports.string().min(1).max(128).regex(NO_CONTROL2).optional(),
       /** The issuer that account id belongs to. */
-      issuer: external_exports.string().min(1).max(512).startsWith("https://").regex(NO_CONTROL).optional(),
+      issuer: external_exports.string().min(1).max(512).startsWith("https://").regex(NO_CONTROL2).optional(),
       signature: RelaySignatureSchema
     });
     HubComputerSummarySchema = external_exports.object({
@@ -129210,6 +129294,23 @@ var init_session_relay_link = __esm({
       /** This computer is linked to a DorkOS account that could not be read just now. */
       "account-unreadable"
     ]);
+    SessionRelayDeviceSchema = external_exports.object({
+      label: external_exports.string(),
+      /** When this computer first saw it (ISO 8601). */
+      firstSeenAt: external_exports.string(),
+      /** When it last asked this computer for something (ISO 8601). */
+      lastSeenAt: external_exports.string()
+    });
+    SessionRelayPresenceSchema = external_exports.object({
+      active: external_exports.boolean(),
+      /** When it became active (ISO 8601); absent while not active. */
+      since: external_exports.string().optional(),
+      /** The browsers seen since then, most recent first; empty while not active. */
+      devices: external_exports.array(SessionRelayDeviceSchema)
+    });
+    SessionRelayDeviceListSchema = external_exports.object({
+      devices: external_exports.array(SessionRelayDeviceSchema)
+    });
   }
 });
 
@@ -129224,6 +129325,7 @@ var init_session_gate = __esm({
     init_server_role();
     init_public_computer();
     init_session_relay_link();
+    init_session_route();
   }
 });
 
@@ -129265,6 +129367,7 @@ var init_auth2 = __esm({
     init_server_role();
     init_seed_legacy_mcp_key();
     init_setup_code_gate();
+    init_session_route();
     init_setup_code();
     init_cookie_security();
     init_session_gate();
@@ -129313,7 +129416,6 @@ function defuseSystemTags(text3, tagNames) {
 var IDENTITY_MAX_LENGTH, INVISIBLE_FORMAT, CONTROL_CHARS, PATTERN_CACHE;
 var init_untrusted_text = __esm({
   "../shared/src/untrusted-text.ts"() {
-    "use strict";
     IDENTITY_MAX_LENGTH = 80;
     INVISIBLE_FORMAT = /[\u00ad\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff\ufff9-\ufffb]/g;
     CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
@@ -129722,6 +129824,9 @@ var init_config_disclosure = __esm({
       // work runs on this machine, names no credential and no person, and an agent
       // that can see it can say why a session behaves the way it does.
       "runtimes.claudeCode.persistentSession": "expose",
+      // How many agents may run at once here (DOR-3012). A number about this
+      // machine, naming no credential and no person.
+      "runtimes.claudeCode.maxWarmProcesses": "expose",
       "runtimes.opencode.defaultModel": "expose",
       "runtimes.codex.defaultModel": "expose",
       "runtimes.codex.defaultEffort": "expose",
@@ -130479,6 +130584,9 @@ var init_config_write_policy = __esm({
       // what makes the verdict cheap: refusing the agent takes nothing away from the
       // person, who was never going to reach for a config door to begin with.
       "runtimes.claudeCode.persistentSession": "operator-only",
+      // How many agents may run at once (DOR-3012): memory on this machine, so the
+      // person sets it, like `scheduler.maxConcurrentRuns`.
+      "runtimes.claudeCode.maxWarmProcesses": "operator-only",
       "runtimes.opencode.defaultModel": "agent-writable",
       "runtimes.codex.defaultModel": "agent-writable",
       "runtimes.codex.defaultEffort": "agent-writable",
@@ -130785,6 +130893,9 @@ var init_config_write_policy = __esm({
           // and the wipe floor says an agent may not widen it back (DOR-1505).
           "uploads.allowedTypes",
           "runtimes.claudeCode.persistentSession",
+          // How many agents may run at once: a person who lowered it to save memory
+          // must not have an agent raise it back (DOR-3012).
+          "runtimes.claudeCode.maxWarmProcesses",
           "scheduler.maxConcurrentRuns",
           // Whether the computer stays awake for the work, and whether it is woken
           // for it: battery, and whether the machine is on while nobody is there.
@@ -131170,21 +131281,45 @@ var init_constants9 = __esm({
        */
       WARM_IDLE_MS: 5 * 60 * 1e3,
       /**
-       * How many sessions may hold a subprocess at once (spec §4.4).
+       * The fewest sessions that may hold a subprocess at once when the ceiling is
+       * sized automatically (spec §4.4; DOR-3012).
        *
-       * This counts PROCESSES; `MAX_SESSIONS` (50) counts session RECORDS, and the
-       * two are deliberately different numbers. Fifty concurrent CLI subprocesses
-       * plus their MCP children on a laptop is not a shape to ship, so warmth stops
-       * at twelve while records stay at fifty — which keeps `ensureSession`'s throw
-       * the genuinely exceptional path it is today.
+       * The ceiling counts PROCESSES; `MAX_SESSIONS` (50) counts session RECORDS,
+       * and the two are deliberately different numbers. It is set by
+       * `runtimes.claudeCode.maxWarmProcesses`, and left unset it is sized to the
+       * machine: one process per {@link SESSIONS.WARM_SESSION_RAM_GB} of memory,
+       * never fewer than this and never more than
+       * {@link SESSIONS.MAX_WARM_SESSIONS_AUTO}. Twelve was the fixed ceiling until
+       * DOR-3012, and a machine with 48 GB filled it with 5.5 GB in use.
        *
-       * It is also **not** a refusal ceiling in the way `MAX_SESSIONS` is. Warmth is
-       * a cache, so the thirteenth warm session does not fail: the least recently
-       * used warm process is reaped to make room for it, and only a host where
-       * nothing is reclaimable — every process mid-turn or parked on a person — is
-       * refused.
+       * It is **not** a refusal ceiling in the way `MAX_SESSIONS` is. Warmth is a
+       * cache, so a launch past it reclaims the least recently used warm process,
+       * and when nothing is reclaimable — every process mid-turn or parked on a
+       * person — it waits for one to come free ({@link SESSIONS.WARM_SLOT_WAIT_MS}).
        */
-      MAX_WARM_SESSIONS: 12,
+      MIN_WARM_SESSIONS: 12,
+      /** The most an automatically sized warm ceiling allows; see {@link SESSIONS.MIN_WARM_SESSIONS}. */
+      MAX_WARM_SESSIONS_AUTO: 32,
+      /**
+       * Memory an automatically sized ceiling budgets per warm process, in GB. A
+       * busy claude-code process measured about 0.5 GB on 2026-10-18; four times
+       * that leaves room for its MCP children and for everything else on the
+       * machine.
+       */
+      WARM_SESSION_RAM_GB: 2,
+      /**
+       * How long a turn waits for a warm slot when every process is busy, before it
+       * is refused in plain words (DOR-3012).
+       *
+       * Long on purpose: a full ceiling is the busiest moment a room has, and a
+       * late answer beats a failed one. Every busy process frees its slot when its
+       * turn ends, so a wait this long means every agent sat on one turn for most
+       * of an hour. Kept under the room's default late-reply ceiling (60 min) so the
+       * room hears the reason rather than giving up first. The turn says it is
+       * waiting on a beat (`SLOT_WAIT_BEAT_MS`), which keeps the stall guard from
+       * mistaking the wait for a stalled turn.
+       */
+      WARM_SLOT_WAIT_MS: 45 * 60 * 1e3,
       /**
        * How long a warm process must be CONTINUOUSLY quiet before its busy spell is
        * over (spec `warm-process-lifecycle` D1).
@@ -131206,7 +131341,7 @@ var init_constants9 = __esm({
        * The same four hours, and the same reasoning, as
        * {@link SESSIONS.INTERACTION_PARK_CEILING_MS}: a hold with no bound is a
        * resource leak with a story attached, and twelve processes pinned by helpers
-       * that will never finish fill `MAX_WARM_SESSIONS` exactly as twelve parked
+       * that will never finish fill the warm ceiling exactly as a ceiling's worth of parked
        * ones do. Deliberately a SEPARATE constant from the person-wait ceiling even
        * though both are four hours: one bounds how long DorkOS waits for a person,
        * the other how long it waits for an agent, and a future change to either
@@ -143029,11 +143164,11 @@ function globalInstallReasonOf(plugin, shared) {
     namedSkills(plugin.skills.map((skill) => skill.name)),
     shared
   );
-  const join61 = (into) => shared ? into : `${into}${into.endsWith(".") ? "" : "."} ${GLOBAL_INSTALL_SHARE_OFFER}`;
+  const join62 = (into) => shared ? into : `${into}${into.endsWith(".") ? "" : "."} ${GLOBAL_INSTALL_SHARE_OFFER}`;
   const timed = plugin.skills.filter((skill) => skill.hasSchedule);
-  if (timed.length === 0) return join61(lead);
+  if (timed.length === 0) return join62(lead);
   const allLinked = timed.every((skill) => skill.linkedInDorkHome === true);
-  return join61(`${lead}. ${allLinked ? GLOBAL_INSTALL_TIMERS_WORK : GLOBAL_INSTALL_TIMERS_PENDING}`);
+  return join62(`${lead}. ${allLinked ? GLOBAL_INSTALL_TIMERS_WORK : GLOBAL_INSTALL_TIMERS_PENDING}`);
 }
 function planGlobalInstallDrops(input4) {
   const projectNames = new Set(
@@ -149602,9 +149737,57 @@ var init_settings_hooks = __esm({
   }
 });
 
+// ../harness/src/apply/opencode-command-orphans.ts
+import { readFileSync as readFileSync16, rmSync as rmSync6 } from "node:fs";
+import { join as join38 } from "node:path";
+function findOpencodeCommandOrphans(repoRoot, plan) {
+  return removableOf(repoRoot, allOpencodeCommandOrphans(repoRoot, plan));
+}
+function allOpencodeCommandOrphans(repoRoot, plan) {
+  const kept = new Set(
+    plan.actions.filter((a2) => a2.kind === "generate" && a2.target?.startsWith(`${OPENCODE_COMMANDS_DIR}/`)).map((a2) => a2.target)
+  );
+  const commandsDir = join38(repoRoot, OPENCODE_COMMANDS_DIR);
+  const orphans = [];
+  for (const entry of listDirEntries(commandsDir)) {
+    if (!entry.isFile()) continue;
+    const rel = `${OPENCODE_COMMANDS_DIR}/${entry.name}`;
+    const abs = join38(commandsDir, entry.name);
+    if (isAtomicTempName(entry.name)) {
+      if (isStaleAtomicTemp(abs)) orphans.push(rel);
+      continue;
+    }
+    if (kept.has(rel)) continue;
+    if (!isEngineGeneratedCommand(abs)) continue;
+    orphans.push(rel);
+  }
+  return orphans;
+}
+function sweepOpencodeCommandOrphans(repoRoot, plan) {
+  const orphans = findOpencodeCommandOrphans(repoRoot, plan);
+  for (const rel of orphans) rmSync6(join38(repoRoot, rel), { force: true });
+  return orphans;
+}
+function isEngineGeneratedCommand(abs) {
+  try {
+    return readFileSync16(abs, "utf8").includes(GENERATED_COMMAND_MARKER);
+  } catch {
+    return false;
+  }
+}
+var init_opencode_command_orphans = __esm({
+  "../harness/src/apply/opencode-command-orphans.ts"() {
+    "use strict";
+    init_installed_projector();
+    init_atomic_write();
+    init_link_state();
+    init_sweep_warnings();
+  }
+});
+
 // ../harness/src/apply/apply.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync16, rmSync as rmSync6, symlinkSync as symlinkSync2 } from "node:fs";
-import { dirname as dirname11, join as join38, relative as relative6 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, rmSync as rmSync7, symlinkSync as symlinkSync2 } from "node:fs";
+import { dirname as dirname11, join as join39, relative as relative6 } from "node:path";
 function skillSourcesUnreadable(plan) {
   return (plan.unreadableSkillRoots?.length ?? 0) > 0;
 }
@@ -149615,13 +149798,13 @@ function scaffoldPresent(absTarget) {
   return pathExists(absTarget) && !isDanglingSymlink(absTarget);
 }
 function relativeLink(repoRoot, source, target) {
-  return relative6(dirname11(join38(repoRoot, target)), absolutePlanPath(repoRoot, source));
+  return relative6(dirname11(join39(repoRoot, target)), absolutePlanPath(repoRoot, source));
 }
 function applySymlink(repoRoot, action) {
   if (!action.source || !action.target) {
     throw new Error(`symlink action for "${action.name}" is missing source/target`);
   }
-  const absTarget = join38(repoRoot, action.target);
+  const absTarget = join39(repoRoot, action.target);
   const linkText = relativeLink(repoRoot, action.source, action.target);
   const absSource = absolutePlanPath(repoRoot, action.source);
   for (let attempt = 0, removalRetries = 0; attempt < SYMLINK_ATTEMPTS; ) {
@@ -149632,7 +149815,7 @@ function applySymlink(repoRoot, action) {
         return void 0;
       }
       try {
-        rmSync6(absTarget, { force: true });
+        rmSync7(absTarget, { force: true });
       } catch (error63) {
         if (!waitForSymlinkRemoval(error63, removalRetries++)) throw error63;
         continue;
@@ -149651,13 +149834,13 @@ function applySymlink(repoRoot, action) {
 }
 function applyScaffold(repoRoot, action) {
   if (!action.target) throw new Error(`scaffold action for "${action.name}" is missing target`);
-  const absTarget = join38(repoRoot, action.target);
+  const absTarget = join39(repoRoot, action.target);
   if (scaffoldPresent(absTarget)) return;
   writeFileAtomic(absTarget, requireActionContent(action));
 }
 function applyGenerate(repoRoot, action) {
   if (!action.target) throw new Error(`generate action for "${action.name}" is missing target`);
-  const absTarget = join38(repoRoot, action.target);
+  const absTarget = join39(repoRoot, action.target);
   const shape = blockingGenerateOccupant(absTarget);
   if (shape !== void 0) return shape;
   const content = requireActionContent(action);
@@ -149671,7 +149854,7 @@ function applyGenerate(repoRoot, action) {
 function applyMerge(repoRoot, action) {
   if (!action.target) throw new Error(`merge action for "${action.name}" is missing target`);
   const managed = JSON.parse(requireActionContent(action));
-  return mergeManagedHooks(join38(repoRoot, action.target), managed);
+  return mergeManagedHooks(join39(repoRoot, action.target), managed);
 }
 function findInstalledOrphans(repoRoot, plan) {
   return removableOf(repoRoot, allInstalledOrphans(repoRoot, plan));
@@ -149683,10 +149866,10 @@ function allInstalledOrphans(repoRoot, plan) {
   );
   const orphans = [];
   for (const dir of INSTALLED_SKILL_DIRS) {
-    const skillsDir = join38(repoRoot, dir);
+    const skillsDir = join39(repoRoot, dir);
     for (const entry of listDir(skillsDir)) {
       if (!entry.includes(INSTALLED_PROJECTION_MARKER)) continue;
-      const abs = join38(skillsDir, entry);
+      const abs = join39(skillsDir, entry);
       if (!isSymlink(abs)) continue;
       const rel = `${dir}/${entry}`;
       if (managed.has(rel)) continue;
@@ -149698,7 +149881,7 @@ function allInstalledOrphans(repoRoot, plan) {
 }
 function sweepInstalledOrphans(repoRoot, plan) {
   const orphans = findInstalledOrphans(repoRoot, plan);
-  for (const rel of orphans) rmSync6(join38(repoRoot, rel), { force: true });
+  for (const rel of orphans) rmSync7(join39(repoRoot, rel), { force: true });
   return orphans;
 }
 function findGeneratedCommandOrphans(repoRoot, plan) {
@@ -149708,14 +149891,14 @@ function allGeneratedCommandOrphans(repoRoot, plan) {
   const kept = new Set(
     plan.actions.filter((a2) => a2.kind === "generate" && a2.target?.startsWith(`${CLAUDE_COMMANDS_DIR}/`)).map((a2) => a2.target)
   );
-  const commandsDir = join38(repoRoot, CLAUDE_COMMANDS_DIR);
+  const commandsDir = join39(repoRoot, CLAUDE_COMMANDS_DIR);
   const orphans = [];
   for (const sub of listDirEntries(commandsDir)) {
     if (!sub.isDirectory()) continue;
-    const subAbs = join38(commandsDir, sub.name);
+    const subAbs = join39(commandsDir, sub.name);
     for (const file2 of listDir(subAbs)) {
       const rel = `${CLAUDE_COMMANDS_DIR}/${sub.name}/${file2}`;
-      const abs = join38(subAbs, file2);
+      const abs = join39(subAbs, file2);
       if (isAtomicTempName(file2)) {
         if (isStaleAtomicTemp(abs)) orphans.push(rel);
         continue;
@@ -149729,68 +149912,33 @@ function allGeneratedCommandOrphans(repoRoot, plan) {
 }
 function sweepGeneratedCommandOrphans(repoRoot, plan) {
   const orphans = findGeneratedCommandOrphans(repoRoot, plan);
-  for (const rel of orphans) rmSync6(join38(repoRoot, rel), { force: true });
+  for (const rel of orphans) rmSync7(join39(repoRoot, rel), { force: true });
   for (const rel of removableOf(repoRoot, emptiedWrapperDirs(repoRoot, plan))) {
-    rmSync6(join38(repoRoot, rel), { recursive: true, force: true });
+    rmSync7(join39(repoRoot, rel), { recursive: true, force: true });
   }
   return orphans;
 }
 function emptiedWrapperDirs(repoRoot, plan) {
-  const commandsDir = join38(repoRoot, CLAUDE_COMMANDS_DIR);
+  const commandsDir = join39(repoRoot, CLAUDE_COMMANDS_DIR);
   const taking = new Set(findGeneratedCommandOrphans(repoRoot, plan));
   const dirs = [];
   for (const sub of listDirEntries(commandsDir)) {
     if (!sub.isDirectory()) continue;
     const rel = `${CLAUDE_COMMANDS_DIR}/${sub.name}`;
-    const listing = tryListDir(join38(commandsDir, sub.name));
+    const listing = tryListDir(join39(commandsDir, sub.name));
     if (listing === void 0) continue;
     if (listing.every((entry) => taking.has(`${rel}/${entry}`))) dirs.push(rel);
   }
   return dirs.sort();
 }
-function findOpencodeCommandOrphans(repoRoot, plan) {
-  return removableOf(repoRoot, allOpencodeCommandOrphans(repoRoot, plan));
-}
-function allOpencodeCommandOrphans(repoRoot, plan) {
-  const kept = new Set(
-    plan.actions.filter((a2) => a2.kind === "generate" && a2.target?.startsWith(`${OPENCODE_COMMANDS_DIR}/`)).map((a2) => a2.target)
-  );
-  const commandsDir = join38(repoRoot, OPENCODE_COMMANDS_DIR);
-  const orphans = [];
-  for (const entry of listDirEntries(commandsDir)) {
-    if (!entry.isFile()) continue;
-    const rel = `${OPENCODE_COMMANDS_DIR}/${entry.name}`;
-    const abs = join38(commandsDir, entry.name);
-    if (isAtomicTempName(entry.name)) {
-      if (isStaleAtomicTemp(abs)) orphans.push(rel);
-      continue;
-    }
-    if (kept.has(rel)) continue;
-    if (!isEngineGeneratedCommand(abs)) continue;
-    orphans.push(rel);
-  }
-  return orphans;
-}
-function sweepOpencodeCommandOrphans(repoRoot, plan) {
-  const orphans = findOpencodeCommandOrphans(repoRoot, plan);
-  for (const rel of orphans) rmSync6(join38(repoRoot, rel), { force: true });
-  return orphans;
-}
-function isEngineGeneratedCommand(abs) {
-  try {
-    return readFileSync16(abs, "utf8").includes(GENERATED_COMMAND_MARKER);
-  } catch {
-    return false;
-  }
-}
 function findBlockedWrapperDirs(repoRoot, plan) {
   const wrapperDirs = new Set(
     plan.actions.filter((a2) => a2.kind === "generate" && a2.target?.startsWith(`${CLAUDE_COMMANDS_DIR}/`)).map((a2) => dirname11(a2.target))
   );
   const blocked = /* @__PURE__ */ new Set();
   for (const relDir of wrapperDirs) {
-    const abs = join38(repoRoot, relDir);
-    const hasForeignContent = listDir(abs).some((entry) => isForeign(join38(abs, entry), entry));
+    const abs = join39(repoRoot, relDir);
+    const hasForeignContent = listDir(abs).some((entry) => isForeign(join39(abs, entry), entry));
     if (hasForeignContent) blocked.add(relDir);
   }
   return blocked;
@@ -149806,7 +149954,7 @@ function findBlockedOpencodeCommandFiles(repoRoot, plan) {
     if (action.kind !== "generate") continue;
     const target = action.target;
     if (!target?.startsWith(`${OPENCODE_COMMANDS_DIR}/`)) continue;
-    const abs = join38(repoRoot, target);
+    const abs = join39(repoRoot, target);
     if (pathExists(abs) && !isEngineGeneratedCommand(abs)) blocked.add(target);
   }
   return blocked;
@@ -149819,11 +149967,11 @@ function allSettingsHooksOrphan(repoRoot, plan) {
     (a2) => a2.kind === "merge" && a2.target === CLAUDE_SETTINGS_LOCAL_TARGET
   );
   if (hasMerge) return [];
-  return hasManagedHooks(join38(repoRoot, CLAUDE_SETTINGS_LOCAL_TARGET)) ? [CLAUDE_SETTINGS_LOCAL_TARGET] : [];
+  return hasManagedHooks(join39(repoRoot, CLAUDE_SETTINGS_LOCAL_TARGET)) ? [CLAUDE_SETTINGS_LOCAL_TARGET] : [];
 }
 function sweepSettingsHooksOrphan(repoRoot, plan) {
   const orphans = findSettingsHooksOrphan(repoRoot, plan);
-  if (orphans.length > 0) sweepManagedHooks(join38(repoRoot, CLAUDE_SETTINGS_LOCAL_TARGET));
+  if (orphans.length > 0) sweepManagedHooks(join39(repoRoot, CLAUDE_SETTINGS_LOCAL_TARGET));
   return orphans;
 }
 function applyPlan(repoRoot, plan, opts) {
@@ -149911,7 +150059,7 @@ function isDrifted(repoRoot, action) {
   switch (action.kind) {
     case "symlink": {
       if (!action.source || !action.target) return true;
-      const absTarget = join38(repoRoot, action.target);
+      const absTarget = join39(repoRoot, action.target);
       const kind = occupantKind(absTarget);
       if (kind === "absent") return true;
       if (kind === "file" || kind === "directory") return false;
@@ -149924,10 +150072,10 @@ function isDrifted(repoRoot, action) {
       );
     }
     case "scaffold":
-      return !action.target || !scaffoldPresent(join38(repoRoot, action.target));
+      return !action.target || !scaffoldPresent(join39(repoRoot, action.target));
     case "generate": {
       if (!action.target) return true;
-      const absTarget = join38(repoRoot, action.target);
+      const absTarget = join39(repoRoot, action.target);
       if (blockingGenerateOccupant(absTarget) !== void 0) return false;
       const onDisk = readFileIfPresent(absTarget);
       if (onDisk === void 0) return true;
@@ -149939,7 +150087,7 @@ function isDrifted(repoRoot, action) {
     case "merge": {
       if (!action.target) return true;
       const managed = JSON.parse(requireActionContent(action));
-      return managedHooksDrift(join38(repoRoot, action.target), managed);
+      return managedHooksDrift(join39(repoRoot, action.target), managed);
     }
     case "native":
     case "drop":
@@ -149951,7 +150099,7 @@ function findBlockedSymlinkTargets(repoRoot, plan) {
   for (const action of plan.actions) {
     if (action.kind !== "symlink" || !action.source || !action.target) continue;
     const reason = blockingSymlinkOccupant(
-      join38(repoRoot, action.target),
+      join39(repoRoot, action.target),
       relativeLink(repoRoot, action.source, action.target)
     );
     if (reason !== void 0) blocked.push({ ...action, reason });
@@ -150057,6 +150205,7 @@ var init_apply = __esm({
     init_sweep_warnings();
     init_installed_projector();
     init_settings_hooks();
+    init_opencode_command_orphans();
     INSTALLED_SKILL_DIRS = [AGENTS_SKILLS_DIR, CLAUDE_SKILLS_DIR];
     SYMLINK_ATTEMPTS = 3;
   }
@@ -150064,7 +150213,7 @@ var init_apply = __esm({
 
 // ../harness/src/adopt/apply.ts
 import { lstatSync as lstatSync12, mkdirSync as mkdirSync6, renameSync as renameSync3, rmdirSync } from "node:fs";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 function applyAdopt(repoRoot, plan) {
   const moved = [];
   const declared = [];
@@ -150082,9 +150231,9 @@ function applyAdopt(repoRoot, plan) {
   return { moved, declared, refusals };
 }
 function applyMove(repoRoot, move) {
-  const absFrom = join39(repoRoot, move.from);
-  const absTo = join39(repoRoot, move.to);
-  const canonicalLayer = join39(repoRoot, ADOPT_TARGET_ROOT);
+  const absFrom = join40(repoRoot, move.from);
+  const absTo = join40(repoRoot, move.to);
+  const canonicalLayer = join40(repoRoot, ADOPT_TARGET_ROOT);
   const layerExisted = somethingIsAt(canonicalLayer);
   mkdirSync6(canonicalLayer, { recursive: true });
   try {
@@ -150128,7 +150277,7 @@ function restore(input4) {
   if (!somethingIsAt(absFrom)) {
     try {
       renameSync3(absTo, absFrom);
-      if (!layerExisted) removeIfEmpty(join39(repoRoot, ADOPT_TARGET_ROOT));
+      if (!layerExisted) removeIfEmpty(join40(repoRoot, ADOPT_TARGET_ROOT));
       return { name: move.name, source: move.from, rule: "link-blocked", reason: blocked };
     } catch {
     }
@@ -150195,10 +150344,10 @@ import {
   lstatSync as lstatSync13,
   mkdirSync as mkdirSync7,
   readlinkSync as readlinkSync5,
-  rmSync as rmSync7,
+  rmSync as rmSync8,
   symlinkSync as symlinkSync3
 } from "node:fs";
-import { basename as basename6, dirname as dirname12, join as join40, relative as relative7, resolve as resolve6, sep as sep8 } from "node:path";
+import { basename as basename6, dirname as dirname12, join as join41, relative as relative7, resolve as resolve6, sep as sep8 } from "node:path";
 function globalSweepDirs(roots) {
   return [
     ...new Set(
@@ -150254,13 +150403,13 @@ function globalOrphanCandidates(plan, roots) {
       if (pkg === void 0) {
         const extension = linkOwnerUnder(abs, extensionRoot);
         if (extension === void 0 || planned.has(abs)) continue;
-        if (!existsSync13(join40(extensionRoot, extension)) || plan.extensionLedger === "read") {
+        if (!existsSync13(join41(extensionRoot, extension)) || plan.extensionLedger === "read") {
           orphans.set(abs, SWEEP_REASONS["global-extension-stopped"]);
         }
         continue;
       }
       if (planned.has(abs)) continue;
-      if (!existsSync13(join40(pluginsRoot, pkg))) {
+      if (!existsSync13(join41(pluginsRoot, pkg))) {
         orphans.set(abs, SWEEP_REASONS["global-package-gone"]);
         continue;
       }
@@ -150287,7 +150436,7 @@ function rawGlobalOrphanPaths(plan, roots) {
 }
 function sweepGlobalOrphans(plan, roots) {
   const orphans = findGlobalOrphans(plan, roots);
-  for (const { path: path66 } of orphans) rmSync7(path66, { force: true });
+  for (const { path: path66 } of orphans) rmSync8(path66, { force: true });
   return orphans;
 }
 function globalLinkText(action) {
@@ -150344,7 +150493,7 @@ function applyGlobalSymlink(action, memo2) {
       if (blocked !== void 0) return { kind: "blocked", reason: blocked };
       if (linkMatchesPlan(absTarget, absSource, linkText, LINK_CHECK)) return { kind: "unchanged" };
       try {
-        rmSync7(absTarget, { force: true });
+        rmSync8(absTarget, { force: true });
       } catch (error63) {
         if (!waitForSymlinkRemoval(error63, removalRetries++)) throw error63;
         continue;
@@ -150591,7 +150740,7 @@ import {
   realpathSync as realpathSync10,
   statSync as statSync10
 } from "node:fs";
-import { basename as basename7, isAbsolute as isAbsolute7, join as join41, relative as relative8, resolve as resolve7, sep as sep9 } from "node:path";
+import { basename as basename7, isAbsolute as isAbsolute7, join as join42, relative as relative8, resolve as resolve7, sep as sep9 } from "node:path";
 function statOrUndefined(path66) {
   try {
     return statSync10(path66, { throwIfNoEntry: false });
@@ -150628,7 +150777,7 @@ function ascendLevels(root, cwd, stopAtWorktree) {
   const levels2 = [];
   for (; ; ) {
     levels2.push(current3);
-    if (stopAtWorktree && existsSync14(join41(current3, ".git"))) break;
+    if (stopAtWorktree && existsSync14(join42(current3, ".git"))) break;
     if (current3 === root) break;
     const parent = resolve7(current3, "..");
     if (parent === current3) break;
@@ -150654,7 +150803,7 @@ function descendScopes(root, facts) {
       if (!entry.isDirectory()) continue;
       if (NEVER_DESCEND.has(entry.name)) continue;
       if (entry.name.startsWith(".") && !listedDotDirs.has(entry.name)) continue;
-      visit2(join41(dir, entry.name), depth + 1);
+      visit2(join42(dir, entry.name), depth + 1);
     }
   };
   visit2(root, 0);
@@ -150666,7 +150815,7 @@ function readDirs(facts, root, cwd) {
   const seen = /* @__PURE__ */ new Set();
   for (const scope3 of scopes) {
     for (const readPath2 of facts.readPaths.project) {
-      const abs = join41(scope3, readPath2);
+      const abs = join42(scope3, readPath2);
       if (seen.has(abs)) continue;
       seen.add(abs);
       dirs.push({ abs, via: viaOf(root, abs) });
@@ -150750,9 +150899,9 @@ function harnessCoverage(harness, root, opts) {
       continue;
     }
     for (const entry of [...entries].sort((a2, b2) => a2.name.localeCompare(b2.name))) {
-      const dir = join41(abs, entry.name);
+      const dir = join42(abs, entry.name);
       if (!statOrUndefined(dir)?.isDirectory()) continue;
-      const skillMd = join41(dir, "SKILL.md");
+      const skillMd = join42(dir, "SKILL.md");
       if (!statOrUndefined(skillMd)?.isFile()) continue;
       const reachedThroughSymlink = lstatOrUndefined(dir)?.isSymbolicLink() === true;
       const { found, reasons, loads, droppedReason } = evaluate(
@@ -150789,21 +150938,21 @@ var init_coverage = __esm({
 
 // ../harness/src/engine.ts
 import { existsSync as existsSync15, lstatSync as lstatSync15, readFileSync as readFileSync18, readdirSync as readdirSync9 } from "node:fs";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 function loadManifest(repoRoot) {
   const raw = JSON.parse(
-    readFileSync18(join42(repoRoot, ".agents", "harness.manifest.json"), "utf8")
+    readFileSync18(join43(repoRoot, ".agents", "harness.manifest.json"), "utf8")
   );
   return parseHarnessManifest(raw);
 }
 function loadClaudeHooks(repoRoot) {
-  const settingsPath = join42(repoRoot, ".claude", "settings.json");
+  const settingsPath = join43(repoRoot, ".claude", "settings.json");
   if (!existsSync15(settingsPath)) return void 0;
   const settings = JSON.parse(readFileSync18(settingsPath, "utf8"));
   return settings.hooks;
 }
 function agentsMdExists(repoRoot) {
-  return existsSync15(join42(repoRoot, "AGENTS.md"));
+  return existsSync15(join43(repoRoot, "AGENTS.md"));
 }
 function claudeCommandsExist(repoRoot) {
   const walk = (dir) => {
@@ -150815,22 +150964,22 @@ function claudeCommandsExist(repoRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".md")) return true;
-      if (entry.isDirectory() && walk(join42(dir, entry.name))) return true;
+      if (entry.isDirectory() && walk(join43(dir, entry.name))) return true;
     }
     return false;
   };
-  return walk(join42(repoRoot, CLAUDE_COMMANDS_DIR));
+  return walk(join43(repoRoot, CLAUDE_COMMANDS_DIR));
 }
 function scanClaudeOnlySkills(repoRoot, manifest) {
   const resolved = /* @__PURE__ */ new Map();
   for (const entry of manifest.claudeOnlySkills) {
     const defaultPath = `${CLAUDE_SKILLS_DIR}/${entry.name}`;
     const path66 = entry.path.trim() === "" ? defaultPath : entry.path;
-    const abs = join42(repoRoot, path66);
+    const abs = join43(repoRoot, path66);
     let kind = "missing";
     const stats2 = lstatSync15(abs, { throwIfNoEntry: false });
     if (stats2?.isSymbolicLink()) kind = "symlink";
-    else if (stats2?.isDirectory() && existsSync15(join42(abs, "SKILL.md"))) kind = "directory";
+    else if (stats2?.isDirectory() && existsSync15(join43(abs, "SKILL.md"))) kind = "directory";
     resolved.set(entry.name, { path: path66, kind, atProjectionTarget: path66 === defaultPath });
   }
   return resolved;
@@ -151178,7 +151327,7 @@ __export(adopt_owned_workspace_exports, {
   autoAdoptFromDisk: () => autoAdoptFromDisk
 });
 import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 function autoAdoptPermitted() {
   return configManager.get("harness").autoAdopt;
 }
@@ -151186,7 +151335,7 @@ function autoAdoptFromDisk(dorkHome) {
   const fallback = UserConfigSchema.shape.harness.parse(void 0).autoAdopt;
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(join43(dorkHome, "config.json"), "utf8"));
+    raw = JSON.parse(readFileSync19(join44(dorkHome, "config.json"), "utf8"));
   } catch {
     return fallback;
   }
@@ -151288,7 +151437,7 @@ var init_adopt_owned_workspace = __esm({
 
 // ../../apps/server/src/services/harness/project-agent-workspace.ts
 import { existsSync as existsSync16, realpathSync as realpathSync11 } from "node:fs";
-import { join as join44, relative as relative9, resolve as resolve8, isAbsolute as isAbsolute8 } from "node:path";
+import { join as join45, relative as relative9, resolve as resolve8, isAbsolute as isAbsolute8 } from "node:path";
 function canonicalize(p) {
   const absolute = resolve8(p);
   try {
@@ -151298,7 +151447,7 @@ function canonicalize(p) {
   }
 }
 function isAgentHome(dir, dorkHome) {
-  const rel = relative9(canonicalize(join44(dorkHome, "agents")), canonicalize(dir));
+  const rel = relative9(canonicalize(join45(dorkHome, "agents")), canonicalize(dir));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute8(rel);
 }
 var AGENT_SKILLS_DIR;
@@ -151310,7 +151459,7 @@ var init_project_agent_workspace = __esm({
     init_dork_home();
     init_logger();
     init_adopt_owned_workspace();
-    AGENT_SKILLS_DIR = join44(".agents", "skills");
+    AGENT_SKILLS_DIR = join45(".agents", "skills");
   }
 });
 
@@ -151319,14 +151468,14 @@ var directory_ownership_exports = {};
 __export(directory_ownership_exports, {
   resolveDirectoryOwnership: () => resolveDirectoryOwnership
 });
-import { join as join45, relative as relative10, sep as sep10 } from "node:path";
+import { join as join46, relative as relative10, sep as sep10 } from "node:path";
 function resolveDirectoryOwnership(dir, dorkHome) {
   if (isAgentHome(dir, dorkHome)) return "agent-home";
   if (isRoomWorktree(dir, dorkHome)) return "room-worktree";
   return "plain";
 }
 function isRoomWorktree(dir, dorkHome) {
-  const rel = relative10(canonicalize(join45(dorkHome, "rooms")), canonicalize(dir));
+  const rel = relative10(canonicalize(join46(dorkHome, "rooms")), canonicalize(dir));
   if (rel === "" || rel.startsWith("..")) return false;
   const parts = rel.split(sep10);
   return parts.length === 3 && parts[1] === "worktrees";
@@ -151338,9 +151487,9 @@ var init_directory_ownership = __esm({
 });
 
 // src/harness-consent.ts
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 function configPathFor(dorkHome) {
-  return join46(dorkHome, "config.json");
+  return join47(dorkHome, "config.json");
 }
 async function readStoredDecisions(dorkHome) {
   const { readHookDecisionsFromDisk: readHookDecisionsFromDisk2 } = await Promise.resolve().then(() => (init_hook_consent(), hook_consent_exports));
@@ -151501,11 +151650,11 @@ __export(global_scope_exports, {
   writeGlobalSharing: () => writeGlobalSharing
 });
 import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join47 } from "node:path";
+import { join as join48 } from "node:path";
 function readGlobalSharingFromDisk(dorkHome) {
   let text3;
   try {
-    text3 = readFileSync20(join47(dorkHome, "config.json"), "utf8");
+    text3 = readFileSync20(join48(dorkHome, "config.json"), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return NOTHING_SHARED;
     return { ...NOTHING_SHARED, unreadable: describeReadFailure2(err) };
@@ -151534,7 +151683,7 @@ function boundaryConfigFromDisk(dorkHome) {
     getDot: (key) => {
       if (key !== "server.boundary") return void 0;
       try {
-        const raw = JSON.parse(readFileSync20(join47(dorkHome, "config.json"), "utf8"));
+        const raw = JSON.parse(readFileSync20(join48(dorkHome, "config.json"), "utf8"));
         const server2 = raw?.server;
         return server2?.boundary;
       } catch {
@@ -151565,7 +151714,7 @@ function resolveGlobalScopeInputs(dorkHome, env6, config3) {
     roots: {
       dorkHome,
       ...AGENTS_SKILLS_DIR_READERS.some((harness) => enabled3.has(harness)) ? { agentsSkillsDir: agentsUserSkillsDir() } : {},
-      ...enabled3.has("claude-code") ? { claudeSkillsDir: join47(inheritedClaudeRoot(), "skills") } : {}
+      ...enabled3.has("claude-code") ? { claudeSkillsDir: join48(inheritedClaudeRoot(), "skills") } : {}
     }
   };
 }
@@ -151575,7 +151724,7 @@ function globalRootsFor(dorkHome, harnesses, env6, config3) {
   return {
     dorkHome,
     ...AGENTS_SKILLS_DIR_READERS.some((harness) => enabled3.has(harness)) ? { agentsSkillsDir: agentsUserSkillsDir() } : {},
-    ...enabled3.has("claude-code") ? { claudeSkillsDir: join47(inheritedClaudeRoot(), "skills") } : {}
+    ...enabled3.has("claude-code") ? { claudeSkillsDir: join48(inheritedClaudeRoot(), "skills") } : {}
   };
 }
 function writeGlobalSharing(harnesses, reason, now3 = /* @__PURE__ */ new Date()) {
@@ -151589,6 +151738,7 @@ function writeGlobalSharing(harnesses, reason, now3 = /* @__PURE__ */ new Date()
 var NOTHING_SHARED;
 var init_global_scope = __esm({
   "../../apps/server/src/services/harness/global-scope.ts"() {
+    "use strict";
     init_src5();
     init_config_schema();
     init_boundary();
@@ -152054,6 +152204,109 @@ var init_harness_sync_global = __esm({
   }
 });
 
+// src/harness-sync-claude-only.ts
+function formatClaudeOnly(claudeOnly, repoRoot) {
+  const { root, plugins, personalHookCommands: hooks } = claudeOnly;
+  const HEADING = "Installed in Claude Code only";
+  if (claudeOnly.unreadable !== void 0) {
+    return [
+      "",
+      HEADING,
+      `  DorkOS could not read ${root}/settings.json, so it cannot tell you what Claude Code has. (${claudeOnly.unreadable})`,
+      "  Nothing else in this report is affected."
+    ];
+  }
+  const notices = claudeOnly.unreadableParts.length + (claudeOnly.skippedEntries ?? 0);
+  if (plugins.length === 0 && notices === 0) return [];
+  const from = (plugin) => plugin.repo === void 0 ? `    - ${plugin.name} (from a source Claude Code calls "${plugin.marketplace}")` : `    - ${plugin.name} (from ${plugin.repo})`;
+  const machineWide = plugins.filter((plugin) => plugin.settingsScope === "user");
+  const inGroup = (offer) => machineWide.filter((plugin) => plugin.offer === offer);
+  const lines = ["", HEADING, `  Read from ${root}`];
+  if (plugins.length > 0) {
+    lines.push(
+      "",
+      `  You turned on ${plugins.length} ${plugins.length === 1 ? "plugin" : "plugins"} in Claude Code. Your other agent tools cannot see them.`
+    );
+  }
+  for (const part of claudeOnly.unreadableParts) {
+    lines.push(
+      "",
+      `  DorkOS could not read the ${part} part of ${root}/settings.json; the plugin list is still right.`
+    );
+  }
+  const skipped = claudeOnly.skippedEntries ?? 0;
+  if (skipped > 0) {
+    lines.push(
+      "",
+      skipped === 1 ? "  DorkOS could not read 1 of the entries in that file, so it is not listed." : `  DorkOS could not read ${skipped} of the entries in that file, so they are not listed.`
+    );
+  }
+  if (plugins.length === 0) return lines;
+  if (hooks > 0) {
+    lines.push(
+      "",
+      `  Your personal Claude Code settings run ${hooks} ${hooks === 1 ? "command" : "commands"} automatically. Only Claude Code runs ${hooks === 1 ? "it" : "them"}.`
+    );
+  }
+  if (claudeOnly.sourcesUnreadable !== void 0) {
+    lines.push(
+      "",
+      `  DorkOS could not read its own list of sources (${claudeOnly.sourcesUnreadable}), so it cannot offer installs right now.`,
+      "",
+      "  Turned on in Claude Code:",
+      ...plugins.map(from),
+      "",
+      "  Your company can also turn plugins on or off, in a settings file DorkOS cannot read. So this list may",
+      "  not be the whole story."
+    );
+    return lines;
+  }
+  const canInstall = inGroup("install");
+  if (canInstall.length > 0) {
+    lines.push(
+      "",
+      "  DorkOS can install these for this project, so every agent tool here gets them:"
+    );
+    for (const plugin of canInstall) {
+      lines.push(from(plugin), `  Run: dorkos install ${plugin.name} --project ${repoRoot}`);
+    }
+    lines.push("  DorkOS has to be running, and it asks you to approve the install first.");
+  }
+  const needsSource = inGroup("add-source-then-install");
+  if (needsSource.length > 0) {
+    lines.push("", "  DorkOS does not have these sources yet:");
+    for (const plugin of needsSource) {
+      lines.push(
+        from(plugin),
+        `  Add the source first: dorkos marketplace add ${plugin.sourceUrl}`
+      );
+    }
+  }
+  const noPackage = inGroup("no-package");
+  if (noPackage.length > 0) {
+    lines.push("", "  DorkOS has that source but nothing by that name:", ...noPackage.map(from));
+  }
+  const unknownSource = inGroup("unknown-source");
+  if (unknownSource.length > 0) {
+    lines.push("", "  DorkOS cannot tell where these came from:", ...unknownSource.map(from));
+  }
+  const projectOnly = plugins.filter((plugin) => plugin.settingsScope === "project");
+  if (projectOnly.length > 0) {
+    lines.push("", "  On for this project only:", ...projectOnly.map(from));
+  }
+  lines.push(
+    "",
+    "  Your company can also turn plugins on or off, in a settings file DorkOS cannot read. So this list may",
+    "  not be the whole story."
+  );
+  return lines;
+}
+var init_harness_sync_claude_only = __esm({
+  "src/harness-sync-claude-only.ts"() {
+    "use strict";
+  }
+});
+
 // ../../apps/server/src/services/harness/project-with-consent.ts
 var project_with_consent_exports = {};
 __export(project_with_consent_exports, {
@@ -152185,11 +152438,11 @@ var init_project_with_consent = __esm({
 import { AsyncLocalStorage as AsyncLocalStorage7 } from "node:async_hooks";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { chmod, mkdir as mkdir3, rename, rm, writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname13, join as join48, resolve as resolve10 } from "node:path";
+import { basename as basename8, dirname as dirname13, join as join49, resolve as resolve10 } from "node:path";
 async function writeUnlocked(filePath, data, options) {
   const dir = dirname13(filePath);
   await mkdir3(dir, { recursive: true });
-  const tempPath = join48(dir, `.${basename8(filePath)}.${process.pid}.${randomUUID3()}.tmp`);
+  const tempPath = join49(dir, `.${basename8(filePath)}.${process.pid}.${randomUUID3()}.tmp`);
   try {
     await writeFile3(tempPath, data, {
       encoding: "utf-8",
@@ -152354,7 +152607,7 @@ var init_git_tree = __esm({
 
 // ../../apps/server/src/services/marketplace/lib/directory-size.ts
 import { lstat as lstat3, readdir as readdir3 } from "node:fs/promises";
-import { join as join49 } from "node:path";
+import { join as join50 } from "node:path";
 async function directorySize(root) {
   let total = 0;
   const walk = async (dir, depth) => {
@@ -152366,7 +152619,7 @@ async function directorySize(root) {
       return;
     }
     for (const entry of entries) {
-      const entryPath = join49(dir, entry.name);
+      const entryPath = join50(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(entryPath, depth + 1);
       } else if (entry.isFile()) {
@@ -152402,7 +152655,7 @@ import {
   stat as stat2,
   utimes
 } from "node:fs/promises";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 function isFetchStatus(value) {
   if (typeof value !== "object" || value === null) return false;
   const v2 = value;
@@ -152494,7 +152747,7 @@ var init_marketplace_cache = __esm({
       entryWrittenListeners = /* @__PURE__ */ new Set();
       /** Compute the cache root path: `${dorkHome}/cache/marketplace`. */
       get cacheRoot() {
-        return join50(this.dorkHome, "cache", "marketplace");
+        return join51(this.dorkHome, "cache", "marketplace");
       }
       /**
        * Read a cached marketplace.json document.
@@ -152525,8 +152778,8 @@ var init_marketplace_cache = __esm({
           if (err instanceof PathEscapeError) return null;
           throw err;
         }
-        const jsonPath = join50(dir, MARKETPLACE_FILENAME);
-        const stampPath = join50(dir, LAST_FETCHED_FILENAME);
+        const jsonPath = join51(dir, MARKETPLACE_FILENAME);
+        const stampPath = join51(dir, LAST_FETCHED_FILENAME);
         let raw;
         let stamp2;
         try {
@@ -152561,9 +152814,9 @@ var init_marketplace_cache = __esm({
       async writeMarketplace(marketplaceName, json3) {
         const dir = this.marketplaceDir(marketplaceName);
         await mkdir4(dir, { recursive: true });
-        await writeFile4(join50(dir, MARKETPLACE_FILENAME), `${JSON.stringify(json3, null, 2)}
+        await writeFile4(join51(dir, MARKETPLACE_FILENAME), `${JSON.stringify(json3, null, 2)}
 `);
-        await writeFile4(join50(dir, LAST_FETCHED_FILENAME), (/* @__PURE__ */ new Date()).toISOString());
+        await writeFile4(join51(dir, LAST_FETCHED_FILENAME), (/* @__PURE__ */ new Date()).toISOString());
       }
       /**
        * Record how an attempt to fetch a marketplace's listing went.
@@ -152582,7 +152835,7 @@ var init_marketplace_cache = __esm({
        *   cache. Callers treat recording as best effort.
        */
       async writeFetchStatus(marketplaceName, status) {
-        const file2 = join50(this.marketplaceDir(marketplaceName), LAST_CHECK_FILENAME);
+        const file2 = join51(this.marketplaceDir(marketplaceName), LAST_CHECK_FILENAME);
         await withFileLock(file2, async (write) => {
           const current3 = await this.readFetchStatus(marketplaceName);
           if (current3 && current3.startedAt > status.startedAt) return;
@@ -152602,8 +152855,8 @@ var init_marketplace_cache = __esm({
         try {
           const dir = this.marketplaceDir(marketplaceName);
           const [stamp2] = await Promise.all([
-            readFile3(join50(dir, LAST_FETCHED_FILENAME), "utf-8"),
-            access(join50(dir, MARKETPLACE_FILENAME))
+            readFile3(join51(dir, LAST_FETCHED_FILENAME), "utf-8"),
+            access(join51(dir, MARKETPLACE_FILENAME))
           ]);
           const at = new Date(stamp2.trim());
           return Number.isNaN(at.getTime()) ? null : at;
@@ -152621,7 +152874,7 @@ var init_marketplace_cache = __esm({
       async readFetchStatus(marketplaceName) {
         try {
           const raw = await readFile3(
-            join50(this.marketplaceDir(marketplaceName), LAST_CHECK_FILENAME),
+            join51(this.marketplaceDir(marketplaceName), LAST_CHECK_FILENAME),
             "utf-8"
           );
           const parsed = JSON.parse(raw);
@@ -152733,8 +152986,8 @@ var init_marketplace_cache = __esm({
        * Idempotent. Not safe while a fetch is running in this cache.
        */
       async removeLeftovers() {
-        await rm2(join50(this.cacheRoot, LEGACY_PACKAGES_DIRNAME), { recursive: true, force: true });
-        const treesRoot = join50(this.cacheRoot, TREES_DIRNAME);
+        await rm2(join51(this.cacheRoot, LEGACY_PACKAGES_DIRNAME), { recursive: true, force: true });
+        const treesRoot = join51(this.cacheRoot, TREES_DIRNAME);
         let entries;
         try {
           entries = await readdir4(treesRoot);
@@ -152744,7 +152997,7 @@ var init_marketplace_cache = __esm({
         await Promise.all(
           entries.filter(
             (entry) => entry.startsWith(TEMP_FETCH_PREFIX) || entry.startsWith(TEMP_PRUNE_PREFIX)
-          ).map((entry) => rm2(join50(treesRoot, entry), { recursive: true, force: true }))
+          ).map((entry) => rm2(join51(treesRoot, entry), { recursive: true, force: true }))
         );
       }
       /**
@@ -152755,9 +153008,9 @@ var init_marketplace_cache = __esm({
        * @internal
        */
       async fetchAndPromote(packageName, subpath, fetch2) {
-        const treesRoot = join50(this.cacheRoot, TREES_DIRNAME);
+        const treesRoot = join51(this.cacheRoot, TREES_DIRNAME);
         await mkdir4(treesRoot, { recursive: true });
-        const tempDir = await mkdtemp(join50(treesRoot, TEMP_FETCH_PREFIX));
+        const tempDir = await mkdtemp(join51(treesRoot, TEMP_FETCH_PREFIX));
         let commitSha;
         let finalPath;
         try {
@@ -152821,7 +153074,7 @@ var init_marketplace_cache = __esm({
        *   removed (the others still are).
        */
       async removeUnused(keep) {
-        const treesRoot = join50(this.cacheRoot, TREES_DIRNAME);
+        const treesRoot = join51(this.cacheRoot, TREES_DIRNAME);
         const entries = await this.listPackages();
         const kept = keep(entries);
         const result2 = { removed: [], freedBytes: 0, failed: [] };
@@ -152836,7 +153089,7 @@ var init_marketplace_cache = __esm({
                 return null;
               }
               if (Date.now() - lastUsedMs < IN_USE_GRACE_MS) return null;
-              const target = join50(treesRoot, `${TEMP_PRUNE_PREFIX}${randomUUID4()}`);
+              const target = join51(treesRoot, `${TEMP_PRUNE_PREFIX}${randomUUID4()}`);
               await rename2(entry.path, target);
               return target;
             });
@@ -152885,7 +153138,7 @@ var init_marketplace_cache = __esm({
        * Listing is not use: it stamps nothing.
        */
       async listPackages() {
-        const root = join50(this.cacheRoot, TREES_DIRNAME);
+        const root = join51(this.cacheRoot, TREES_DIRNAME);
         let entries;
         try {
           entries = await readdir4(root);
@@ -152899,7 +153152,7 @@ var init_marketplace_cache = __esm({
           if (!parsed) {
             continue;
           }
-          const path66 = join50(root, entry);
+          const path66 = join51(root, entry);
           try {
             const info2 = await stat2(path66);
             if (!info2.isDirectory()) {
@@ -152928,8 +153181,8 @@ var init_marketplace_cache = __esm({
        *   the cache.
        */
       marketplaceDir(marketplaceName) {
-        const root = join50(this.cacheRoot, "marketplaces");
-        return assertContainedIn(root, join50(root, marketplaceName));
+        const root = join51(this.cacheRoot, "marketplaces");
+        return assertContainedIn(root, join51(root, marketplaceName));
       }
       /**
        * Compute the directory path for a content-addressable package tree:
@@ -152949,10 +153202,10 @@ var init_marketplace_cache = __esm({
        *   the cache.
        */
       packageDir(packageName, commitSha, subpath) {
-        const root = join50(this.cacheRoot, TREES_DIRNAME);
+        const root = join51(this.cacheRoot, TREES_DIRNAME);
         const digest2 = subpathDigest(subpath);
         const tree = digest2 === "" ? "" : `${SUBPATH_SEPARATOR}${digest2}`;
-        return assertContainedIn(root, join50(root, `${packageName}@${commitSha}${tree}`));
+        return assertContainedIn(root, join51(root, `${packageName}@${commitSha}${tree}`));
       }
     };
   }
@@ -153013,7 +153266,7 @@ var init_source_url_policy = __esm({
 
 // ../../apps/server/src/services/marketplace/sources/marketplace-source-manager.ts
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 function buildDefaultSources() {
   const now3 = (/* @__PURE__ */ new Date()).toISOString();
   return [
@@ -153089,7 +153342,7 @@ var init_marketplace_source_manager = __esm({
        */
       constructor(dorkHome) {
         this.dorkHome = dorkHome;
-        this.filePath = join51(dorkHome, MARKETPLACES_FILENAME);
+        this.filePath = join52(dorkHome, MARKETPLACES_FILENAME);
       }
       dorkHome;
       filePath;
@@ -153529,7 +153782,7 @@ __export(harness_sync_command_exports, {
   runHarnessSync: () => runHarnessSync
 });
 import { existsSync as existsSync18, readFileSync as readFileSync21 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 import { parseArgs as parseArgs4 } from "node:util";
 function parseHarnessSyncArgs(rawArgs) {
   let parsed;
@@ -153656,7 +153909,7 @@ function reportCodexTrust(before, after) {
 }
 function reportClaudeSkillsRestart(existedBefore, repoRoot) {
   if (existedBefore) return;
-  if (!existsSync18(join52(repoRoot, CLAUDE_SKILLS_DIR))) return;
+  if (!existsSync18(join53(repoRoot, CLAUDE_SKILLS_DIR))) return;
   const facts = skillsFactsFor("claude-code");
   console.log("");
   console.log(`Created ${CLAUDE_SKILLS_DIR}/, which is where Claude Code reads skills.`);
@@ -153667,107 +153920,11 @@ function reportClaudeSkillsRestart(existedBefore, repoRoot) {
 }
 function readIfPresent(repoRoot, rel) {
   try {
-    return readFileSync21(join52(repoRoot, rel), "utf8");
+    return readFileSync21(join53(repoRoot, rel), "utf8");
   } catch {
     return void 0;
   }
 }
-function formatClaudeOnly(claudeOnly, repoRoot) {
-  const { root, plugins, personalHookCommands: hooks } = claudeOnly;
-  const HEADING = "Installed in Claude Code only";
-  if (claudeOnly.unreadable !== void 0) {
-    return [
-      "",
-      HEADING,
-      `  DorkOS could not read ${root}/settings.json, so it cannot tell you what Claude Code has. (${claudeOnly.unreadable})`,
-      "  Nothing else in this report is affected."
-    ];
-  }
-  const notices = claudeOnly.unreadableParts.length + (claudeOnly.skippedEntries ?? 0);
-  if (plugins.length === 0 && notices === 0) return [];
-  const from = (plugin) => plugin.repo === void 0 ? `    - ${plugin.name} (from a source Claude Code calls "${plugin.marketplace}")` : `    - ${plugin.name} (from ${plugin.repo})`;
-  const machineWide = plugins.filter((plugin) => plugin.settingsScope === "user");
-  const inGroup = (offer) => machineWide.filter((plugin) => plugin.offer === offer);
-  const lines = ["", HEADING, `  Read from ${root}`];
-  if (plugins.length > 0) {
-    lines.push(
-      "",
-      `  You turned on ${plugins.length} ${plugins.length === 1 ? "plugin" : "plugins"} in Claude Code. Your other agent tools cannot see them.`
-    );
-  }
-  for (const part of claudeOnly.unreadableParts) {
-    lines.push(
-      "",
-      `  DorkOS could not read the ${part} part of ${root}/settings.json; the plugin list is still right.`
-    );
-  }
-  const skipped = claudeOnly.skippedEntries ?? 0;
-  if (skipped > 0) {
-    lines.push(
-      "",
-      skipped === 1 ? "  DorkOS could not read 1 of the entries in that file, so it is not listed." : `  DorkOS could not read ${skipped} of the entries in that file, so they are not listed.`
-    );
-  }
-  if (plugins.length === 0) return lines;
-  if (hooks > 0) {
-    lines.push(
-      "",
-      `  Your personal Claude Code settings run ${hooks} ${hooks === 1 ? "command" : "commands"} automatically. Only Claude Code runs ${hooks === 1 ? "it" : "them"}.`
-    );
-  }
-  if (claudeOnly.sourcesUnreadable !== void 0) {
-    lines.push(
-      "",
-      `  DorkOS could not read its own list of sources (${claudeOnly.sourcesUnreadable}), so it cannot offer installs right now.`,
-      "",
-      "  Turned on in Claude Code:",
-      ...plugins.map(from),
-      "",
-      "  Your company can also turn plugins on or off, in a settings file DorkOS cannot read. So this list may",
-      "  not be the whole story."
-    );
-    return lines;
-  }
-  const canInstall = inGroup("install");
-  if (canInstall.length > 0) {
-    lines.push(
-      "",
-      "  DorkOS can install these for this project, so every agent tool here gets them:"
-    );
-    for (const plugin of canInstall) {
-      lines.push(from(plugin), `  Run: dorkos install ${plugin.name} --project ${repoRoot}`);
-    }
-    lines.push("  DorkOS has to be running, and it asks you to approve the install first.");
-  }
-  const needsSource = inGroup("add-source-then-install");
-  if (needsSource.length > 0) {
-    lines.push("", "  DorkOS does not have these sources yet:");
-    for (const plugin of needsSource) {
-      lines.push(
-        from(plugin),
-        `  Add the source first: dorkos marketplace add ${plugin.sourceUrl}`
-      );
-    }
-  }
-  const noPackage = inGroup("no-package");
-  if (noPackage.length > 0) {
-    lines.push("", "  DorkOS has that source but nothing by that name:", ...noPackage.map(from));
-  }
-  const unknownSource = inGroup("unknown-source");
-  if (unknownSource.length > 0) {
-    lines.push("", "  DorkOS cannot tell where these came from:", ...unknownSource.map(from));
-  }
-  const projectOnly = plugins.filter((plugin) => plugin.settingsScope === "project");
-  if (projectOnly.length > 0) {
-    lines.push("", "  On for this project only:", ...projectOnly.map(from));
-  }
-  lines.push(
-    "",
-    "  Your company can also turn plugins on or off, in a settings file DorkOS cannot read. So this list may",
-    "  not be the whole story."
-  );
-  return lines;
-}
 function formatNotEnabled(plan) {
   if (plan.notEnabled.length === 0) return [];
   const enableWith = (harness) => `add it to ${HARNESS_MANIFEST_PATH} or run dorkos harness sync --fix --enable ${harness}`;
@@ -153994,7 +154151,7 @@ async function runHarnessSync(args) {
   }
   const repoRoot = process.cwd();
   const ourHarness = await readDorkosHarness(resolveDorkHome2());
-  if (!existsSync18(join52(repoRoot, HARNESS_MANIFEST_PATH))) {
+  if (!existsSync18(join53(repoRoot, HARNESS_MANIFEST_PATH))) {
     if (!args.fix) {
       console.error(`No harness manifest in ${repoRoot}`);
       console.error(`  looked for: ${HARNESS_MANIFEST_PATH}`);
@@ -154074,7 +154231,7 @@ async function runHarnessSync(args) {
       return { exitCode: strictExit(exitCode2, withheld, args.strict) };
     }
     const codexHooksBefore = readIfPresent(repoRoot, CODEX_HOOKS_TARGET);
-    const claudeSkillsExistedBefore = existsSync18(join52(repoRoot, CLAUDE_SKILLS_DIR));
+    const claudeSkillsExistedBefore = existsSync18(join53(repoRoot, CLAUDE_SKILLS_DIR));
     const result2 = projectWithConsent2(repoRoot, {
       ...consentOpts,
       sweepOrphans: harnessFilter === void 0
@@ -154111,6 +154268,7 @@ var init_harness_sync_command = __esm({
     init_harness_consent();
     init_harness_sync_allow_hooks();
     init_harness_sync_global();
+    init_harness_sync_claude_only();
     init_src5();
     SUMMARY_KINDS = ["native", "symlink", "scaffold", "generate", "merge"];
     USAGE_LINE5 = "Usage: dorkos harness sync [--check] [--fix] [--global] [--harness <id>] [--strict] [--allow-hooks <package>] [--enable <harness>] [--write-gitignore]";
@@ -154132,7 +154290,7 @@ __export(harness_adopt_command_exports, {
   runHarnessAdopt: () => runHarnessAdopt
 });
 import { existsSync as existsSync19 } from "node:fs";
-import { join as join53, resolve as resolve11 } from "node:path";
+import { join as join54, resolve as resolve11 } from "node:path";
 import { parseArgs as parseArgs5 } from "node:util";
 function parseHarnessAdoptArgs(rawArgs) {
   let parsed;
@@ -154173,7 +154331,7 @@ ${USAGE_LINE6}`
 }
 async function runHarnessAdopt(args) {
   const repoRoot = args.project === void 0 ? process.cwd() : resolve11(process.cwd(), args.project);
-  if (!existsSync19(join53(repoRoot, HARNESS_MANIFEST_PATH))) {
+  if (!existsSync19(join54(repoRoot, HARNESS_MANIFEST_PATH))) {
     console.error(`No harness manifest in ${repoRoot}`);
     console.error(`  looked for: ${HARNESS_MANIFEST_PATH}`);
     console.error("");
@@ -157141,7 +157299,7 @@ import { spawn } from "node:child_process";
 import { randomBytes as randomBytes5, createHash as createHash7 } from "node:crypto";
 import { constants as constants6 } from "node:fs";
 import { lstat as lstat5, open as open4, realpath as realpath4 } from "node:fs/promises";
-import { join as join54, resolve as resolve12, relative as relative11, isAbsolute as isAbsolute10, dirname as dirname14 } from "node:path";
+import { join as join55, resolve as resolve12, relative as relative11, isAbsolute as isAbsolute10, dirname as dirname14 } from "node:path";
 function requireFact2(value, code) {
   if (!value) throw new InstallationFailure(code);
 }
@@ -157422,10 +157580,10 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
       sameBinding(request.attempt.binding, slot.binding) && sameBinding(request.candidate.binding, slot.binding),
       "BINDING_MISMATCH"
     );
-    const attempt = join54(config3.cacheRoot, "attempts", slot.binding.attemptId);
-    const candidate = join54(config3.cacheRoot, "candidates", slot.binding.installationId);
+    const attempt = join55(config3.cacheRoot, "attempts", slot.binding.attemptId);
+    const candidate = join55(config3.cacheRoot, "candidates", slot.binding.installationId);
     requireFact2(
-      request.attempt.attemptRoot === attempt && request.attempt.homeRoot === join54(attempt, "home") && request.attempt.temporaryRoot === join54(attempt, "tmp") && request.candidate.candidateRoot === candidate && request.candidate.payloadRoot === join54(candidate, "payload"),
+      request.attempt.attemptRoot === attempt && request.attempt.homeRoot === join55(attempt, "home") && request.attempt.temporaryRoot === join55(attempt, "tmp") && request.candidate.candidateRoot === candidate && request.candidate.payloadRoot === join55(candidate, "payload"),
       "BINDING_MISMATCH"
     );
     await assertDirectory(attempt, request.attempt.identity);
@@ -157434,7 +157592,7 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
     await assertDirectory(request.candidate.payloadRoot);
     await assertDirectory(config3.libraryRoot);
     requireFact2(
-      request.library.distributionSHA256 === INSTALLATION_TARGET.libraryDistributionSHA256 && request.library.cli.path === join54(config3.libraryRoot, "cli.js") && request.library.browsersManifest.path === join54(config3.libraryRoot, "browsers.json") && request.library.files.length > 0 && request.library.files.length <= INSTALLATION_LIMITS.libraryEntries,
+      request.library.distributionSHA256 === INSTALLATION_TARGET.libraryDistributionSHA256 && request.library.cli.path === join55(config3.libraryRoot, "cli.js") && request.library.browsersManifest.path === join55(config3.libraryRoot, "browsers.json") && request.library.files.length > 0 && request.library.files.length <= INSTALLATION_LIMITS.libraryEntries,
       "LIBRARY_MISMATCH"
     );
     const paths2 = /* @__PURE__ */ new Set();
@@ -157469,9 +157627,9 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
       PATH: dirname14(config3.nodeExecutable) + ":/usr/bin:/bin",
       HOME: home2,
       TMPDIR: temporary,
-      XDG_CONFIG_HOME: join54(home2, ".config"),
-      XDG_CACHE_HOME: join54(home2, ".cache"),
-      XDG_DATA_HOME: join54(home2, ".local", "share"),
+      XDG_CONFIG_HOME: join55(home2, ".config"),
+      XDG_CACHE_HOME: join55(home2, ".cache"),
+      XDG_DATA_HOME: join55(home2, ".local", "share"),
       NODE_DISABLE_COMPILE_CACHE: "1",
       ...payload ? { PLAYWRIGHT_BROWSERS_PATH: payload } : {},
       LC_ALL: "C",
@@ -157804,17 +157962,17 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
     },
     async runVersionProbe(request) {
       const slot = register("version-probe", request.binding, request.bounds);
-      const attempt = join54(config3.cacheRoot, "attempts", slot.binding.attemptId);
+      const attempt = join55(config3.cacheRoot, "attempts", slot.binding.attemptId);
       return execute(
         slot,
         request,
         request.executable.path,
         ["--version"],
         request.cwd,
-        environment(join54(attempt, "home"), join54(attempt, "tmp")),
+        environment(join55(attempt, "home"), join55(attempt, "tmp")),
         async () => {
           requireFact2(
-            request.cwd === attempt && request.executable.path === join54(
+            request.cwd === attempt && request.executable.path === join55(
               config3.cacheRoot,
               "candidates",
               slot.binding.installationId,
@@ -157823,8 +157981,8 @@ function createInstallationJobs(configuration, options = { ownerKind: "controlle
             "BINDING_MISMATCH"
           );
           await assertDirectory(attempt);
-          await assertDirectory(join54(attempt, "home"));
-          await assertDirectory(join54(attempt, "tmp"));
+          await assertDirectory(join55(attempt, "home"));
+          await assertDirectory(join55(attempt, "tmp"));
           await sourceIntake(slot);
           await readPinned(
             slot,
@@ -157887,7 +158045,7 @@ var init_status2 = __esm({
 });
 
 // ../browser/src/runtime/installation/transaction.ts
-import { join as join55 } from "node:path";
+import { join as join56 } from "node:path";
 function require2(value, code) {
   if (!value) throw new InstallationFailure(code);
 }
@@ -157951,7 +158109,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
     require2(facts.cleanupCauses.length === 0 && !facts.stopRequested && facts.exitObserved && facts.closeObserved, "CUSTODY_UNCERTAIN");
     require2(facts.exitCode === 0 && facts.signal === null, role2 === "official-install" ? "INSTALLER_FAILED" : "VERIFIER_FAILED");
     const birth = facts.birth;
-    require2(birth && sameBinding(birth.binding, expected) && birth.role === role2 && birth.jobId === facts.jobId && birth.executable === config3.nodeExecutable && canonicalDigest(birth.bounds) === canonicalDigest(bounds) && birth.cwd === join55(config3.cacheRoot, "attempts", expected.attemptId) && Number.isSafeInteger(birth.pid) && birth.pid > 0 && canonicalDigest(birth.argv) === canonicalDigest(argv2), "BINDING_MISMATCH");
+    require2(birth && sameBinding(birth.binding, expected) && birth.role === role2 && birth.jobId === facts.jobId && birth.executable === config3.nodeExecutable && canonicalDigest(birth.bounds) === canonicalDigest(bounds) && birth.cwd === join56(config3.cacheRoot, "attempts", expected.attemptId) && Number.isSafeInteger(birth.pid) && birth.pid > 0 && canonicalDigest(birth.argv) === canonicalDigest(argv2), "BINDING_MISMATCH");
     for (const [stream, bytes] of [
       [facts.stdout, run.stdout],
       [facts.stderr, run.stderr]
@@ -157964,11 +158122,11 @@ function createInstallationTransaction(configuration, dependencies, generation3)
   };
   const validateLibrary = (library) => {
     require2(library.distributionSHA256 === INSTALLATION_TARGET.libraryDistributionSHA256, "LIBRARY_MISMATCH");
-    require2(library.cli.path === join55(config3.libraryRoot, "cli.js") && library.browsersManifest.path === join55(config3.libraryRoot, "browsers.json"), "LIBRARY_MISMATCH");
+    require2(library.cli.path === join56(config3.libraryRoot, "cli.js") && library.browsersManifest.path === join56(config3.libraryRoot, "browsers.json"), "LIBRARY_MISMATCH");
     require2(library.files.length > 0 && library.files.length <= INSTALLATION_LIMITS.libraryEntries, "LIBRARY_MISMATCH");
   };
   const validateCandidate = (candidate, expected) => {
-    require2(candidate.installationId === expected.installationId && candidate.candidateRoot === join55(config3.cacheRoot, "candidates", expected.installationId) && candidate.payloadRoot === join55(candidate.candidateRoot, "payload") && candidate.executable.path === join55(candidate.candidateRoot, INSTALLATION_TARGET.executablePath), "OWNERSHIP_UNCERTAIN");
+    require2(candidate.installationId === expected.installationId && candidate.candidateRoot === join56(config3.cacheRoot, "candidates", expected.installationId) && candidate.payloadRoot === join56(candidate.candidateRoot, "payload") && candidate.executable.path === join56(candidate.candidateRoot, INSTALLATION_TARGET.executablePath), "OWNERSHIP_UNCERTAIN");
     FileIdentitySchema.parse(candidate.executable.identity);
     DigestSchema.parse(candidate.executable.sha256);
     DigestSchema.parse(candidate.inventoryDigest);
@@ -158155,7 +158313,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         recordBytes(journal, INSTALLATION_LIMITS.journalBytes);
         check4(bounds, options.signal);
         const written = await fs40.writeReuseJournal(reservation, attempt, journal);
-        require2(written.path === join55(attempt.attemptRoot, "reuse.json") && written.sha256 === sha2562(recordBytes(journal, INSTALLATION_LIMITS.journalBytes)), "OWNERSHIP_UNCERTAIN");
+        require2(written.path === join56(attempt.attemptRoot, "reuse.json") && written.sha256 === sha2562(recordBytes(journal, INSTALLATION_LIMITS.journalBytes)), "OWNERSHIP_UNCERTAIN");
         const unchanged = await fs40.inspectExisting({ signal: options.signal });
         require2(canonicalDigest(unchanged.current) === canonicalDigest(reserved.current) && canonicalDigest(unchanged.installation) === canonicalDigest(reserved.installation), "ROOT_CHANGED");
         journalDigest = written.sha256;
@@ -158263,7 +158421,7 @@ import { createHash as createHash8 } from "node:crypto";
 import { constants as constants7 } from "node:fs";
 import { lstat as lstat6, open as open5, realpath as realpath5 } from "node:fs/promises";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname15, join as join56, resolve as resolve13 } from "node:path";
+import { dirname as dirname15, join as join57, resolve as resolve13 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function sameFile(a2, b2) {
   return a2.isFile() && b2.isFile() && a2.dev === b2.dev && a2.ino === b2.ino && a2.size === b2.size && a2.mtimeNs === b2.mtimeNs && a2.ctimeNs === b2.ctimeNs && a2.mode === b2.mode && a2.uid === b2.uid;
@@ -158324,7 +158482,7 @@ async function inspectFile(filename, cap, retainBytes = false) {
 async function packageRoot(controller) {
   let directory = dirname15(controller);
   while (true) {
-    const candidate = join56(directory, "package.json");
+    const candidate = join57(directory, "package.json");
     let named3 = null;
     try {
       named3 = await lstat6(candidate, { bigint: true });
@@ -158344,10 +158502,10 @@ async function packageRoot(controller) {
 async function resolveInstalledRuntimeConfiguration(controllerURL, dataDirectory) {
   const controllerEntry = await realpath5(fileURLToPath6(controllerURL));
   const root = await packageRoot(controllerEntry);
-  if (controllerEntry !== join56(root, "dist/bin/cli.js"))
+  if (controllerEntry !== join57(root, "dist/bin/cli.js"))
     throw new Error("The managed browser needs the packaged DorkOS command.");
-  const verifierEntry = join56(root, BROWSER_VERIFIER_ASSET);
-  const sourceManifestPath = join56(root, BROWSER_SOURCE_MANIFEST);
+  const verifierEntry = join57(root, BROWSER_VERIFIER_ASSET);
+  const sourceManifestPath = join57(root, BROWSER_SOURCE_MANIFEST);
   const nodeExecutable = await realpath5(process.execPath);
   const node2 = await inspectFile(nodeExecutable, 268435456);
   const controller = await inspectFile(controllerEntry, INSTALLATION_LIMITS.controllerBytes);
@@ -162682,7 +162840,7 @@ var init_provider_process = __esm({
 // src/commands/community-deploy/runtime/github-release-source.ts
 import { mkdtemp as mkdtemp2, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 function createGitHubCommunityReleaseSource(options) {
   const verify = async (subject, trusted) => {
     await runProviderCommand({
@@ -162728,8 +162886,8 @@ function createGitHubCommunityReleaseSource(options) {
       return result2.value;
     },
     verifyManifest: async (bytes, trusted) => {
-      const directory = await mkdtemp2(join57(tmpdir3(), "dorkos-community-manifest-"));
-      const path66 = join57(directory, "manifest.json");
+      const directory = await mkdtemp2(join58(tmpdir3(), "dorkos-community-manifest-"));
+      const path66 = join58(directory, "manifest.json");
       try {
         await writeFile5(path66, bytes, { mode: 384, flag: "wx" });
         return await verify(path66, trusted);
@@ -165483,7 +165641,7 @@ var init_community_release_manifest = __esm({
 // src/commands/community-deploy/fly-config.ts
 import { mkdtemp as mkdtemp3, rm as rm4, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 function tomlString(value) {
   return JSON.stringify(value);
 }
@@ -165536,8 +165694,8 @@ kill_timeout = "30s"
 `;
 }
 async function withCommunityFlyConfig(plan, consumer) {
-  const directory = await mkdtemp3(join58(tmpdir4(), "dorkos-community-fly-"));
-  const path66 = join58(directory, "fly.toml");
+  const directory = await mkdtemp3(join59(tmpdir4(), "dorkos-community-fly-"));
+  const path66 = join59(directory, "fly.toml");
   try {
     await writeFile6(path66, renderCommunityFlyConfig(plan), { mode: 384, flag: "wx" });
     return await consumer(path66);
@@ -165980,7 +166138,7 @@ var init_default_deploy = __esm({
 // src/commands/community-deploy/runtime/default-owner.ts
 import { access as access2, constants as constants9, stat as stat4 } from "node:fs/promises";
 import { platform as platform2 } from "node:os";
-import { delimiter, join as join59 } from "node:path";
+import { delimiter, join as join60 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as stdin2, stdout as stdout2 } from "node:process";
 async function ask(question, signal) {
@@ -166013,7 +166171,7 @@ function handoffCommands(system) {
 async function executableOnPath(executable, path66) {
   for (const directory of path66.split(delimiter).filter(Boolean)) {
     try {
-      await access2(join59(directory, executable), constants9.X_OK);
+      await access2(join60(directory, executable), constants9.X_OK);
       return true;
     } catch {
     }
@@ -166045,7 +166203,7 @@ async function assertOwnerHandoffPrerequisites(env6, system = platform2()) {
         `Owner handoff needs an active Wayland clipboard session before setup can create resources. See ${FLY_GUIDE_URL}`
       );
     }
-    const socketAvailable = await stat4(join59(runtimeDirectory, display)).then(
+    const socketAvailable = await stat4(join60(runtimeDirectory, display)).then(
       (value) => value.isSocket(),
       () => false
     );
@@ -166230,10 +166388,10 @@ import {
   rm as rm5,
   unlink as unlink2
 } from "node:fs/promises";
-import { basename as basename9, dirname as dirname16, join as join60 } from "node:path";
+import { basename as basename9, dirname as dirname16, join as join61 } from "node:path";
 function launchJournalPath(dorkHome, runId) {
   const safeRunId = external_exports.uuid().parse(runId);
-  return join60(dorkHome, "launches", "community", `${safeRunId}.json`);
+  return join61(dorkHome, "launches", "community", `${safeRunId}.json`);
 }
 async function rejectSymlink(path66) {
   try {
@@ -166270,7 +166428,7 @@ async function exists2(path66) {
 }
 async function writeDurably(filePath, data) {
   const directory = dirname16(filePath);
-  const temporary = join60(
+  const temporary = join61(
     directory,
     `.${basename9(filePath)}.${process.pid}.${randomUUID6()}.durable`
   );
@@ -166367,7 +166525,7 @@ async function readLaunchJournal(filePath) {
   }
 }
 async function listIncompleteLaunchJournals(dorkHome) {
-  const directory = join60(dorkHome, "launches", "community");
+  const directory = join61(dorkHome, "launches", "community");
   await rejectSymlink(dirname16(directory));
   await rejectSymlink(directory);
   let filenames;
@@ -170552,6 +170710,7 @@ var init_connection_copy = __esm({
 var CONNECTOR_OPERATION_SELECTION_LIMIT, CONNECTOR_AUTHENTICATION_FLOW_TTL_MS, CONNECTOR_EVENT_REVIEW_SCOPE_LIMIT, ConnectorJsonValueSchema, ConnectorJsonObjectSchema, ConnectorProviderInstanceIdSchema, ConnectionIdSchema, ConnectorExternalAccountRefSchema, ConnectorProviderModeSchema, ConnectorProviderHealthSchema, ConnectorGrantReconciliationStatusSchema, ConnectorOperationClassificationSchema, ConnectorAccessLevelSchema, ConnectorRetryPolicySchema, ConnectorOperationRevisionSchema, ConnectorOperationPageSchema, ConnectorCapabilityAvailabilitySchema, ConnectorUnsupportedResultSchema, ConnectorProviderCapabilitySetSchema, ConnectorToolkitVersionResultSchema, ConnectorProviderExecuteResultSchema, ConnectorAuthenticationFlowSchema, ConnectorExecutionTargetSchema, ConnectorProgramExecutionRequestSchema, ConnectorExecutionPublicResultSchema, ConnectorExecutionResponseSchema, ConnectionReadinessStateSchema, ConnectionReadinessReasonSchema, ConnectionFixActionSchema, ConnectionFixSchema, ConnectionReadinessSchema, AccessibleConnectorConnectionSchema, AccessibleConnectorOperationSchema, ConnectorAccessibleConnectionsResponseSchema, ConnectorAccessibleOperationsResponseSchema, ConnectorUsageItemSchema, ConnectorUsagePageSchema, ConnectorReconciliationPreviewRequestSchema, ConnectorReconciliationGrantSelectionSchema, ConnectorReconciliationEveryAgentSelectionSchema, ConnectorReconciliationEveryAgentStateSchema, ConnectorEveryAgentRevokeResponseSchema, ConnectorReconciliationAgentSchema, ConnectorReconciliationCandidateSchema, ConnectorReconciliationPreviewSchema, ConnectorReconciliationApplyRequestSchema, ConnectorReconciliationApplyResponseSchema, ReviewActionBaseSchema, ConnectionTargetSchema, ConnectorRequestAccessSchema, ConnectorReviewActionSchema, ConnectorAgentConnectionRequestInputSchema, ConnectorAgentRequestBaseSchema, ConnectorRequestNotGrantedSchema, ConnectorAgentRequestStatusSchema, ConnectorAgentRequestItemSchema, ConnectorAgentRequestListResponseSchema, ConnectorManagementConnectActionSchema, ConnectorManagementAppliedActionSchema, ConnectorManagementReviewActionSchema, ConnectorManagementReviewCreateRequestSchema, ConnectorManagementReviewOutcomeSchema, ConnectorManagementReviewOperationContextSchema, ConnectorManagementReviewConnectionContextSchema, ConnectorManagementReviewAgentContextSchema, ConnectorManagementReviewContextSchema, ManagementReviewItemBaseShape, ConnectorPendingManagementReviewItemSchema, ConnectorResolvingManagementReviewItemSchema, ConnectorExpiredManagementReviewItemSchema, ConnectorDeniedManagementReviewItemSchema, ConnectorApprovedAppliedManagementReviewItemSchema, ConnectorApprovedConnectManagementReviewItemSchema, ConnectorApprovedUnknownManagementReviewItemSchema, ConnectorManagementReviewItemSchema, ProgramReviewStatusBaseShape, ConnectorProgramReviewStatusSchema, ConnectorManagementReviewDecisionSchema, ConnectorManagementReviewDecisionResultSchema;
 var init_connector_schemas = __esm({
   "../connector-providers/src/connector-schemas.ts"() {
+    "use strict";
     init_zod();
     init_connection_copy();
     CONNECTOR_OPERATION_SELECTION_LIMIT = 1e5;
@@ -176677,7 +176836,7 @@ if (process.argv[2] === "community") {
     );
     Object.assign(childEnv, credentialEnv.pickCommunityCredentialEnv(rawProcessEnv));
     const exitCode = await dispatcher.runCommunityDispatcher(process.argv.slice(3), {
-      cliVersion: "0.121.0",
+      cliVersion: "0.123.0",
       dorkHome: DORK_HOME,
       processEnv: childEnv,
       parseRelease: (bytes) => releaseContract.parseCompatibleCommunityReleaseManifest(
@@ -176695,7 +176854,7 @@ if (process.argv[2] === "community") {
     process.exit(1);
   }
 }
-var cliErrorReporter = initCliErrorReporting({ dorkHome: DORK_HOME, version: "0.121.0" });
+var cliErrorReporter = initCliErrorReporting({ dorkHome: DORK_HOME, version: "0.123.0" });
 var uninstallCliErrorHandlers = cliErrorReporter ? installCliErrorHandlers(cliErrorReporter) : void 0;
 if (process.argv[2] === "doctor") {
   process.env.DORK_HOME = DORK_HOME;
@@ -176705,7 +176864,7 @@ if (process.argv[2] === "doctor") {
 if (process.argv[2] === "feedback") {
   process.env.DORK_HOME = DORK_HOME;
   const { runFeedback: runFeedback2 } = await Promise.resolve().then(() => (init_feedback2(), feedback_exports));
-  process.exit(await runFeedback2(DORK_HOME, "0.121.0", process.argv.slice(3)));
+  process.exit(await runFeedback2(DORK_HOME, "0.123.0", process.argv.slice(3)));
 }
 if (process.argv[2] === "auth") {
   process.env.DORK_HOME = DORK_HOME;
@@ -176804,7 +176963,7 @@ if (process.argv[2] === "agent" || process.argv[2] === "task" || process.argv[2]
     }
   }
   const { runVersionDispatcher: runVersionDispatcher2 } = await Promise.resolve().then(() => (init_version5(), version_exports));
-  process.exit(await runVersionDispatcher2("0.121.0", DORK_HOME, subArgs));
+  process.exit(await runVersionDispatcher2("0.123.0", DORK_HOME, subArgs));
 }
 var { values, positionals } = parseCliArgs();
 if (positionals[0] && !knownCommands.has(positionals[0])) {
@@ -176898,14 +177057,14 @@ Examples:
   process.exit(0);
 }
 if (values.version) {
-  console.log("0.121.0");
+  console.log("0.123.0");
   process.exit(0);
 }
 if (values["post-install-check"]) {
   const claudeFound = checkClaude();
   const coreExtensionsFound = checkCoreExtensions();
   const extensionsCompile = await checkExtensionCompilation();
-  console.log(`dorkos ${"0.121.0"}`);
+  console.log(`dorkos ${"0.123.0"}`);
   if (!coreExtensionsFound) {
     console.log("Installation incomplete \u2014 bundled core extensions are missing.");
   }
@@ -177053,7 +177212,7 @@ if (fs39.existsSync(envPath)) {
 }
 uninstallCliErrorHandlers?.();
 process.env.DORKOS_CLI_ENTRYPOINT = fileURLToPath7(import.meta.url);
-process.env.DORKOS_CLI_VERSION = "0.121.0";
+process.env.DORKOS_CLI_VERSION = "0.123.0";
 var server;
 try {
   server = await import("../server/index.js");
@@ -177078,7 +177237,7 @@ var ansiReset = "\x1B[0m";
 console.log("");
 console.log(`${purple}${logo}${ansiReset}`);
 console.log("");
-console.log(`  DorkOS v${"0.121.0"}`);
+console.log(`  DorkOS v${"0.123.0"}`);
 console.log(`  Local:   ${link(localUrl, localUrl)}`);
 var nets = networkInterfaces();
 var networkUrl = null;
@@ -177104,9 +177263,9 @@ if (shouldOpenBrowser && process.stdin.isTTY) {
   const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   exec(`${openCmd} ${localUrl}`);
 }
-checkForUpdate("0.121.0").then((latestVersion) => {
+checkForUpdate("0.123.0").then((latestVersion) => {
   if (latestVersion) {
-    const msg = `Update available: ${"0.121.0"} \u2192 ${latestVersion}`;
+    const msg = `Update available: ${"0.123.0"} \u2192 ${latestVersion}`;
     const cmd = "Run npm install -g dorkos@latest to update";
     const width = Math.max(msg.length, cmd.length) + 6;
     const pad2 = (s2) => `\u2502   ${s2}${" ".repeat(width - s2.length - 6)}   \u2502`;